36:03This recording is not available yet.
API Secrets are weak proxies for Machine Identity
Download resourcesCategories
Vendors and tools discussed
Sponsored by
About this session
Anusha Iyer, co-founder and CTO of Corsha, argues that the API keys, OAuth tokens and PKI certificates used to authenticate machine-to-machine traffic are all rooted in static secrets that behave like system passwords: set to never expire, rarely rotated, embedded in code and infrastructure-as-code, shared across dozens of workloads and leaked through CI systems, logs and chat. After a tour of Gartner's API hype cycle and the zero-trust notion of non-person entities, she recalls the recent GitHub and Travis CI credential leaks, then reviews emerging models for a better posture: key management systems such as HashiCorp Vault or a cloud KMS, certificate automation with cert-manager in Kubernetes, service meshes like Istio and Linkerd for greenfield microservices, and API gateways as a uniform enforcement layer. She briefly presents Corsha's approach of multi-factor authentication for machines with one-time credentials pinned to trusted clients. Her takeaways: build secrets rotation into ops calendars, audit service accounts, scan artifacts for leaked secrets with GitGuardian, TruffleHog or Gitleaks, and layer authentication. A short Q&A covers protecting public APIs and session persistence.
Today most API communication between machines is secured through API Secrets - static keys, tokens or PKI certificates that act like system passwords in order to authenticate machines and broker communication between machines. These machines could be cloud workloads, pods, containers, servers, VMs, microservices, and of course physical machines like servers or IoT devices. Perfect security hygiene would mean each API secret is uniquely assigned to only one machine, never shared, and routinely rotated, AND securely distributed through development and deployment systems to the machine that needs it without worry of being leaked along the way. The reality is API secrets are often shared across dozens or hundreds of machines and workloads. They are rarely if ever rotated, and secrets distribution and management across different applications and environments is a very arduous task. More recently, the static nature of API secrets has made them ripe targets for adversaries. Secrets are getting leaked in code repositories, CI systems like Jenkins or Travis, orchestration tools like Kubernetes, cloud hosting environments like AWS, GCP and Azure, as well as logging tools like Splunk and Elastic, even collaboration environments like Slack. In this presentation, Corsha’s Co-founder and CTO Anusha Iyer will walk through why the API secrets are often easy prey for bad actors and weak proxies for machine identity and how to better secure API communication between machines.
Key takeaways
- Treat API keys, client secrets and long-lived certificates as system passwords: set them to expire, put rotation on an ops calendar and never share one secret across workloads.
- Audit service accounts across every platform; most organisations discover far more provisioned machine accounts than they knew about.
- Add secrets scanning (GitGuardian, TruffleHog, Gitleaks) to the CI/CD pipeline and build SIEM analytics that look for the pattern of a cloud API key in logs.
- Automate certificate lifetimes with cert-manager in Kubernetes, or a service mesh for greenfield microservices, instead of issuing three-year certificates to avoid rotation.
- Put an API gateway in front of public APIs and layer authentication (mTLS plus token, an extra challenge on sensitive endpoints) to raise the bar for an attacker holding a stolen credential.
Speakers
Anusha Iyer
Anusha Iyer is the CTO and Co-Founder of Corsha. She is a technology leader with over 15 years of experience in security-minded software, analytics, and managed services. A Carnegie Mellon alum, she started in the Washington, DC area at the Naval… Read moreRead less
Anusha Iyer is the CTO and Co-Founder of Corsha. She is a technology leader with over 15 years of experience in security-minded software, analytics, and managed services. A Carnegie Mellon alum, she started in the Washington, DC area at the Naval Research Lab. At NRL, her focus was on reverse engineering and tactical edge networking. Most recently, she was the Director of Software Programs at Galois, Inc., managing DARPA contracts in the areas of privacy, cyber-mission planning, and software diversity. At Corsha, Anusha is passionate about making security accessible, easy to adopt, even self-assuring.
