80% of enterprises struggle to protect machine identities

Ninety-six percent of companies believe that effective protection of machine and human identities are equally important to the long-term security and viability of their companies, according to a new study conducted by Forrester Consulting. However, eighty percent of respondents struggle with the delivery of important machine identity protection capabilities.

The study focused on enterprise machine identity protection challenges and included responses from 350 senior IT security professionals who are responsible for their organizations’ identity and access management from the U.S., U.K., Germany, France and Australia.

“It is shocking that so many companies don’t understand the importance of protecting their machine identities,” said Jeff Hudson, CEO of Venafi. “We spend billions of dollars protecting user names and passwords but almost nothing protecting the keys and certificates that machines use to identify and authenticate themselves. The number of machines on enterprise networks is skyrocketing and most organizations haven’t invested in the intelligence or automation necessary to protect these critical security assets. The bad guys know this, and they are targeting them because they are incredibly valuable assets across a wide range of cyber-attacks.”

Nearly half (forty-seven percent) believe protecting machine identities and human identities will be equally important to their organizations over the next 12 to 24 months, while nearly as many (forty-three percent) think machine identity protection will be more important.

Seventy percent admit they are tracking fewer than half of the most common types of machine identities found on their networks. When asked which specific machine identities they track:

• Just fifty-six percent say cloud platform instance machine identities
• Only forty-nine percent say mobile device machine identities
• Only forty-nine percent say physical server machine identities
• Only twenty-nine percent say SSH keys
• Only a quarter (twenty-five percent) say machine identities of microservices and containers.

Sixty-one percent say their biggest concern regarding poor machine identity protection management is internal data theft or loss.

Managing user and machine identities and privileged access to business data and applications is an enormous undertaking that has serious security ramifications. Traditionally, the focus for identity and access management (IAM) programs has been people-centric, but recent increases in the number of machines on enterprise networks, shifts in technology and new computing capabilities have created a set of challenges that require increased focus on protecting machine identities.