![Much-Needed MFA for Machine Identities in the World of Automation [Corsha] - cover graphic](/_next/image/?url=https%3A%2F%2Fcdn.venafi.com%2F994513b8-133f-0003-9fb3-9cbe4b61ffeb%2Fe88a490f-1b5d-4b55-a0c9-181e22e1bbf0%2Fshutterstock_1738659032.jpg%3Fw%3D864%26h%3D370%26fm%3Dwebp%26q%3D75%26fit%3Dcrop&w=3840&q=75&dpl=dpl_9nMnPWFgUR3MNGqVKD9tfneGCtKt){kind=small}
Let me start by telling you something that many of you—application developers, DevSecOps, folks and those that manage application ecosystem systems—probably already know deep down: API secrets are just system passwords. Right? And you need to be sure that your API machine identities are strong enough to protect your business. Because honestly, they tend to be weak machine identities. They are often shared, rarely rotated, and sometimes set to never expire. But they also easily get leaked, sprayed, and sprawled across environments. These are some of the many reasons why Gartner has named API attacks as the most prevalent growing attack vector.
So when we think about cybersecurity strategies and enterprises, what's interesting is that automation in cloud and scale are driving us more and more towards human less compute. Humans are growing by three percent, machines by fifty percent. And yet, most of the strategy around identity and access management is focused on humans, their identity and their credentials. But the reality is that most of the traffic across our networks is machine-to-machine, whether that machine is a Kubernetes pod in the cloud, a Lambda, a virtual server, or even industrial IoT equipment on a shop floor.
If 85% of our traffic is machine-to-machine and most of it is API driven, not UI driven, shouldn't we apply to machines the same security best practices that we demand of human-driven communication? Especially in the API world, we need to learn from the human identity, credential, and access Management (ICAM). We should look at how to leverage and integrate techniques that have worked for human identity and access management, like multi-factor authentication or MFA, for example.
CIO Study: Automation Vital to Address Shorter Lifespans and Massive Growth of TLS/SSL Certificates
So let me tell you a little bit about Corsha. We are a cyber security startup in the DC area and focused very much on elevating API identities and machine identities to be first class citizens in world of application ecosystems.
The work we do sits at the intersection of machine identity, zero trust, and API security. And we're focused on automation, automation, automation. We’re passionate about how we can help security, identity, and access keep pace with automation, especially in workflows like DevSecOps pipelines, secure data movement, and security operations centers where data is constantly moving.
Think of Corsha, at a high level, like a Google Authenticator at the API edge, where we can ensure that every single credential, every API call, goes with a one-time use credential. And we effectively pin access to only trusted API clients that should be talking into your system services and application ecosystems. And of course, observability and control are a big part of API Identity and Access Management, especially for the ability to do things like halt resume API access, and pinpoint control at the API edge regardless of what that shape, size or location that API client takes.
At Corsha, we make it seamless to bring MFA and strong IAM to APIs, with no code change required on either the service or the client's side. We're very excited to be a Machine Identity Management Development Fund partner, which allows us to help you take our integration with TLS Protect all the way to the API edge regardless of the shape, size, form factor or where your API clients live.
Hundreds of partners. Thousands of proven integrations. Endless possibilities.
Machine Identity Security Summit 2024
Help us forge a new era of cybersecurity
☕ We're spilling all the machine identiTEA Oct. 1-3, but these insights are too valuable to just toss in the harbor! Browse the agenda and register now.