Addressing the growing threat of non-human identities with PKI
summary
Non-human identities outnumber human ones ~50:1 and contribute to ~80% of breaches, so the claim is that automating PKI fixes orphaned “zombie” NHIs. Vault issues and auto‑renews X.509 certs via Vault Agent and Vault Secrets Operator, supports OpenShift/Kubernetes workflows, EST/CMPv2/SCAP for devices, ACME, and upcoming Spiffy support. Demo issues leaf certs with 30s TTL (intermediate 6 months, root 1 year) and shows immediate rotation and revocation working end‑to‑end, reducing manual ticketing and outage windows.
AI-written summary · about
chapters (9)
- 0:00Introduction to talk
- 1:46Rising threat of non-human identities
- 6:25Why PKI certificates for NHIs
- 8:58Challenges in traditional PKI
- 11:47Modern PKI with Vault
- 14:57Architecture and scalability
- 17:45Live PKI demo walkthrough
- 23:48Future enhancements and roadmap
- 26:36Resources and closing
related talks
29mKeys, Certs and Vault: From DevSecOps to Post-Quantum
13mAutomating PKI: Paddy Power Betfair's Journey with Vault
40mDigital Identities - 21 PKI Pitfalls and How Best to Avoid Them
51mRun modern PKI workflows with HCP Vault on AWS
39mManaging Trust Between Multiple Clouds and Non-human Identities Without Passwords
49mHerding Certs - How to Automate Certificate Management
56mIoT: Taking PKI Where No PKI Has Gone Before
14mAutomated (PKI) Infrastructure: The AI You Should Be Thinking About