The DevOps workflow is all about automation driven by machine-to-machine access. To maintain the automated DevOps pipeline, engineers configure service accounts with credentials such as passwords, API tokens, certificates, etc. The issue is that engineers often fall into the security mispractice of creating long-lived credentials for service accounts to facilitate automation and lessen manual intervention.
This blog post was originally released on 08/26/20. What’s worse than an unsafe private key? An unsafe public key. The “secure” in secure shell comes from the combination of hashing, symmetric encryption, and asymmetric encryption. Together, SSH uses cryptographic primitives to safely connect clients and servers. In the 25 years since its founding, computing power and speeds in accordance with Moore’s Law have necessitated increasingly complicated low-level algorithms.
The four-eyes principle means an activity must be approved by two people, or from Argus Panoptes if the ancient Greeks needed access controls. This principle is commonly used in both routine and non-routine scenarios. On the routine side are “Business Execution” processes. Here the Four Eyes principle is used to stop negative outcomes as the result of poor execution of a regular business task.
In this blog post we're excited to announce Machine ID, an easy way for developers to secure machine-to-machine communications based on X.509 and SSH certificates. But before we go deeper, let’s step back and think about what’s happening during a hacking attempt. Every security breach has two things in common. Addressing cybersecurity challenges requires a solution to both.
https://goteleport.com/blog/machine-to-machine-access/
0:00 Introduction
0:16 Teleport MachineID
2:05 Teleport Desktop Access GA
3:38 Teleport Database Access
What is an SSH bastion and how is this different from an SSH jump server or an SSH proxy? In this post, we’ll answer this question and will show you how to set it up using two popular open source projects. Both Teleport and OpenSSH support bastions, and they are extremely similar as they are both single-binary Linux daemons. Both require a simple configuration file usually stored somewhere under /etc/.
Zero standing privilege (ZSP) is an applied zero trust security strategy for privileged access management (PAM). The term zero standing privilege was coined by an analyst at Gartner. In practice, it implies no users should be pre-assigned with administrative account privileges. Zero-trust security forbids authorization based on static predefined trust boundaries.
