devopsy.kinsta.cloud

Tag: Venafi

  • Venafi Adds Ability to Prevent Unauthorized Code From Running

    Venafi Adds Ability to Prevent Unauthorized Code From Running

    Venafi added an ability to prevent unauthorized code from running in IT environments that make use of its machine identity management platform.

    Shivajee Samdarshi, chief product officer at Venafi, said the Stop Unauthorized Code Solution leverages the company’s CodeSign Protect offering to ensure that only authorized code can run on any given platform.

    The overall goal is to enable organizations to better secure their software supply chains using a zero-trust approach to software based on identity management and code signing to verify software comes from an approved source and complies with policy controls, he added.

    All code is signed using private digital certificates or those issued by trusted certificate authorities, said Samdarshi. Before code can execute, the security platforms an organization has in place can be configured to check that digital signature against trusted code signing certificates, he noted.

    Interest in securing software supply chains has risen sharply since the Biden administration issued an executive order requiring federal agencies to implement a range of measures, including code signing, to achieve that goal. However, securing software chains is often more challenging than organizations initially appreciate.

    In fact, a recent Venafi survey found that 70% of security and IT leaders believe that software supply chain attacks are their biggest security blind spot. Additionally, 85% believe that continuous security validation of the CI/CD pipeline is vital to reduce the risk of vulnerabilities going undetected during the software development lifecycle. A full 88% said they believe machine identity management is essential to the success of zero-trust models that are being more widely adopted across enterprise IT environments.

    Arguably, the most important thing organizations need to focus on is making sure application developers and cybersecurity professionals develop a working relationship. The biggest barrier to the adoption of DevSecOps best practices required to secure software supply chains remains largely cultural. For more years than anyone cares to admit, many developers have viewed cybersecurity more as a hindrance to application development that needs to be overcome or circumvented rather than being a core aspect of a quality assurance process. The total number of vulnerabilities that exist in applications running in production environments could likely be measured in the billions.

    Remediating all those vulnerabilities may never be practical, but at the very least, DevSecOps teams could make sure that no new code containing vulnerabilities is allowed to execute. Cybercriminals have become especially adept at inserting malware into code that they hope will find its way into any number of downstream applications before they activate it. That capability alone should help mollify cybersecurity teams that are increasingly being tasked with improving software supply chain security. The challenge is those cybersecurity teams don’t always appreciate the impact new policies can have on the pace at which applications are developed and deployed.

    Like it or not, software supply chains will generally be more secure in 2024. The only thing that remains to be determined is how much friction will be injected into DevSecOps workflows to achieve that goal.

  • Certificates a Fly in the DevOps Ointment

    Certificates a Fly in the DevOps Ointment

    The way cybersecurity teams have managed certificates is turning out to be a major impedance that could best be addressed by more organizations adopting best DevSecOps practices in 2020.

    A survey of 108 attendees at the recent DevOps Enterprise Summit 2019 conference conducted by Venafi, a provider of tools for assigning identities to machines, finds 75% of respondents said they are concerned that corporate certificate issuance policies slow down development.

    In addition, 39% of respondents believe developers should be able to circumvent corporate certificate issuance policies to meet service level agreements (SLAs) and about half (48%) said they are confident that developers always request certificates through authorized channels.

    Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, said the root cause of the friction between developers and cybersecurity teams can be traced to reliance on ticket-based systems for managing IT. DevOps teams in the age of the software engineer are building and deploying applications faster than ticket-based systems based on manual requests can keep up with, he said.

    Rather than wait on IT Operations teams, DevOps teams are doing an end-run as business leaders push for applications to be deployed faster. In many cases, DevOps teams are attaining certificates directly from a cloud service provider such as Amazon Web Services (AWS), Bocek noted. Unfortunately, that can lead to other issues: More than half of respondents(55%) said their organization experienced a certificate-related outage in the past 12 months. Not all those outages are likely to have resulted from DevOps teams working without internal IT, but it does confirm how deeply flawed the existing process of issuing certifications already is.

    To address that issue, Bocek said organizations will need to shift to an approach for issuing trusted certificates that is based on a standard set of REST application programming interfaces (APIs) and is a natural extension of the DevOps processes baked into a continuous integration/continuous delivery (CI/CD) pipeline.

    Unfortunately, most organizations are not especially aware of best practices for issuing trusted certificates. The Venafi survey found three-quarters of respondents (75%) are unfamiliar with the “Securing Web Transactions 1800-16 Practice Guide,” available in draft form from the National Institute of Standards and Technology (NIST).

    Bocek said the days when cybersecurity teams could employ certificates as a means for governing when applications are deployed are all but over. Cybersecurity teams need to collaborate with DevOps teams to define a set of best DevSecOps processes through which trusted certificates still play a role in helping secure the IT environment without slowing down the application deployment process, he said.

    It may take a while for DevOps teams and cybersecurity professionals to get on the same page in terms of issuing certificates. However, as pressure to deploy applications faster continues to mount, cybersecurity teams will need to adjust their policies and processes. How certificates are issued may be as good a place to start their DevSecOps transition as any.

    — Mike Vizard

  • Venafi Adds Six Developers to Machine Identity Protection Development Fund

    accessec, APIIDA, Crypto4A, Difenda, EDJ Enterprises and Nous Infosystems latest developers to receive fund sponsorship

     

    SALT LAKE CITY – June 27, 2019 – Venafi®, the inventor and leading provider of machine identity protection, today announced direct sponsorship of six new developers in the Machine Identity Protection Development Fund, Venafi’s $12.5 million initiative to protect all machine identities. The funded developers will create integrations that accelerate the delivery of comprehensive protection for machine identities across complex enterprise networks. The Development Fund is a global initiative and will increase the visibility, intelligence and automation required for machine identity protection.

    “Cyberattackers have moved beyond stealing human identities, like usernames and passwords, and are now targeting the identities of machines,” said Kevin Bocek, vice president of security strategy and threat intelligence for Venafi. “Venafi invented the technology that protects machine identities, and we’re recruiting developers worldwide to deliver machine identity protection across the entire enterprise. With the Development Fund, Venafi is accelerating the protection of all machine identities.”

    The new developers joining the Machine Identity Protection Development Fund include:

    • accessec, trusted consultancies for CSOs, CISOs and CTOs on IT security issues, will use fund sponsorship to build a machine identity protection integration for industrial programmable logic controllers (PLCs). Until now, PLCs have not had a standard for machine identity protection due to a lack of standard software and interfaces. accessec will develop machine identity protection for PLCs connected to the Venafi platform. accessec is based in Germany and advises some of the world’s largest automotive brands.
    • APIIDA, a specialist in API, identity and access software solutions, will use fund sponsorship to build a direct integration with the Venafi platform and Broadcom Layer7 API Management (formally CA). APIIDA will also support the Venafi platform in the APIIDA API Gateway Manager delivering machine identity automation previously not available to Layer7 customers. Currently, API gateways operate as standalone instances and do not include automation for TLS machine identities. The APIIDA Gateway Manager makes it possible to automate TLS machine identities across multiple API gateways, allowing organizations to scale API services safely and securely. APIIDA is based in Germany.
    • Crypto4A, a leader in quantum-ready cybersecurity solutions, will use fund sponsorship to help organizations achieve the highest possible entropy and secure key storage and post-quantum ready PKI. post-quantum world where cryptographic systems cannot be trusted, including machine identities. As a result of Development Fund sponsorship, Crypto4A’s quantum ready HSMs will support the Venafi platform, including central key generation with Advanced Key Protect. In addition, Venafi platform customers will be able to issue privately trusted digital certificates from a CA built-into Crypto4A HSMs. Crypto4A is based in Canada.
    • Difenda, a global cybersecurity leader with experience helping companies manage risk and defend against cyber threats, is using fund sponsorship to develop a ServiceNow application for the Venafi platform. For enterprise users familiar with ServiceNow, the application will simplify the complete life cycle of machine identities with customizable request forms and orchestration workflows. Difenda’s ServiceNow solution will automate the entire process, from digital certificate requests to deployment, renewal and  provisioning of critical applications, such as F5 BIG-IP and Microsoft IIS. Difenda is based in Canada.
    • EDJ Enterprises, a leading developer of productivity solutions and PCI compliance tools for retail and grocery store environments, will use fund sponsorship to allow customers to automate the secure rotation of SSH keys for Toshiba 4690 controllers, which grant privileged access and remote administration, in point-of-sale (POS) systems. EDJ is the first Development Fund participant helping to secure SSH machine identities and is based in the United States.
    • Nous Infosystems, a leading global IT services provider with a fast growing ServiceNow practice, will use fund sponsorship to expand on its existing ServiceNow integration. Nous will make it easy for application owners to self-service machine identities without extensive training or onboarding, enabling Venafi platform customers to accelerate their machine identity protection strategy. The Nous solution for ServiceNow has been certified by ServiceNow and is available through the ServiceNow Store. Nous is based in the United States.

    The Machine Identity Protection Development Fund encourages recipients to build integrations that deliver greater visibility, intelligence and automation across any technology that creates or consumes machine identities, including:

    • Cloud and hybrid cloud infrastructure.
    • DevOps.
    • Containerization.
    • Secure Shell (SSH).
    • Code signing.
    • Robotic Process Automation (RPA).
    • Artificial intelligence, machine learning and big data analytics.
    • IoT.
    • Blockchain distributed ledger technology.

    To find out more about the Venafi Machine Identity Protection Development Fund and how you can become a funded developer, please visit: https://www.venafi.com/machine-identity-protection-fund.

    About Venafi

    Venafi is the cybersecurity market leader in machine identity protection, securing machine-to-machine connections and communications. Venafi protects machine identity types by orchestrating cryptographic keys and digital certificates for SSL/TLS, IoT, mobile and SSH. Venafi provides global visibility of machine identities and the risks associated with them for the extended enterprise – on premises, mobile, virtual, cloud and IoT – at machine speed and scale. Venafi puts this intelligence into action with automated remediation that reduces the security and availability risks connected with weak or compromised machine identities while safeguarding the flow of information to trusted machines and preventing communication with machines that are not trusted.

    With over 30 patents, Venafi delivers innovative solutions for the world’s most demanding, security-conscious Global 5000 organizations and government agencies, including the top five U.S. health insurers; the top five U.S. airlines; four of the top five U.S., U.K., Australian and South African banks; and four of the top five U.S. retailers. Venafi is backed by top-tier investors, including TCV, Foundation Capital, Intel Capital, QuestMark Partners, Mercato Partners and NextEquity.

    For more information, visit: www.venafi.com.

  • Venafi and DigiCert Machine Identity Protection Partnership Delivers New Solution for Large-Scale Enterprise PKI

    SALT LAKE CITY – December 6, 2018 — Venafi, the leading provider of machine identity protection, and DigiCert, the world’s leading provider of TLS/SSL, IoT and other PKI solutions, today announced a new, deeper integration that simplifies and automates complex machine identity programs for the world’s most demanding, security-conscious organizations. The combined  solution enables organizations to customize and orchestrate public key infrastructure (PKI) and machine identity protection at machine speed and scale.

    “The rapid adoption of DevOps, microservices, cloud, and IoT requires a new level of technical sophistication and innovation to deliver protection for all machine identities,” said Kevin Bocek, vice president of security strategy and threat intelligence for Venafi. “The Global 5000  are looking for a certificate provider that tightly integrates with the Venafi Platform and provides them with the confidence of a complete solution. DigiCert is the leading CA of choice for large enterprises.”(1)

    The integrated solution leverages DigiCert’s industry-leading, globally dispersed, modern OCSP infrastructure and a deep API integration with Venafi’s industry-leading machine identity protection platform. The new, adaptable driver allows customers to access a rich set of new features from DigiCert CertCentral. Mutual customers can customize specific features, from fully automating certificate provisioning to enforcing internal policies, allowing them to easily address industry regulations such as PCI DSS, HIPAA  and GDPR as well as the most demanding use cases. The integrated solution also simplifies the integration of machine identity protection across a wide variety of systems and allows customers to fulfill high-value certificate requests in seconds. Venafi solutions support the most popular CertCentral features out-of-the box.

    “DigiCert enjoys a long-standing history of collaboration and integration with Venafi, and we share mutual enterprise customers that benefit from their robust platforms and services,” said Dan Timpson, chief technology officer to DigiCert. “In an era when enterprises face increasing threats from a growing landscape of connected devices and agile deployments, Venafi provides leading solutions for addressing machine identity and digital certificate management. We are looking for additional ways to work together to support enterprise customers.”

    Key features of the integration include:

    • Provides full visibility into the demand, usage and workflow of certificate services.
    • Reduces risk with automated policy and workflows, including configurable approval and authorization, and detailed logging.
    • Achieves compliance for workflow approvals, authorization and authentication.
    • Supports the full certificate lifecycle from request, issuance, and renewal to revocation.

    For more information please visit:

    https://www.venafi.com/techpartner/digicert

     

    1. DigiCert maintains the largest market share for the Alexa Top 1000 as measured by Datanyze. https://www.datanyze.com/market-share/ssl/Alexa%20top%201K/

    About DigiCert, Inc.

    DigiCert is the world’s leading provider of scalable PKI solutions for identity and encryption. The most innovative companies, including the Global 2000, choose DigiCert for its expertise in identity and encryption for web servers and Internet of Things devices. DigiCert supports TLS/SSL and other digital certificates for PKI deployments at any scale through its certificate lifecycle management platform, CertCentral®. The company has been recognized with dozens of awards for its enterprise-grade management platform, fast and knowledgeable customer support, and market-leading growth. For the latest DigiCert news and updates, visit digicert.com or follow @digicert.

    About Venafi

    Venafi is the cyber security market leader in machine identity protection, securing machine-to-machine connections and communications. Venafi protects machine identity types by orchestrating cryptographic keys and digital certificates for SSL/TLS, IoT, mobile and SSH. Venafi provides global visibility of machine identities and the risks associated with them for the extended enterprise – on premises, mobile, virtual, cloud and IoT – at machine speed and scale. Venafi puts this intelligence into action with automated remediation that reduces the security and availability risks connected with weak or compromised machine identities while safeguarding the flow of information to trusted machines and preventing communication with machines that are not trusted.

    With 31 patents currently in its portfolio, Venafi , delivers innovative solutions for the world’s most demanding, security-conscious Global 5000 organizations, including the top five U.S. health insurers; the top five U.S. airlines; four of the top five U.S., U.K., Australian and South African banks; and four of the top five U.S. retailers. Venafi is backed by top-tier investors, including TCV, Foundation Capital, Intel Capital, QuestMark Partners, Mercato Partners and NextEquity. For more information visit: www.venafi.com.