Aembit — RSA Conference 2024 Innovation Sandbox

Aembit — RSA Conference 2024 Innovation Sandbox

Speakers: David Goldschlag, Co-founder and CEO, Aembit

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=6BXO4AVm9zE

Overview

In a world increasingly driven by automated software, the challenge of securing access to sensitive data and services by non-human entities – known as workloads – has escalated to a critical point. David Goldschlag, co-founder and CEO of Aembit, presented a compelling case at the RSA Conference 2024 Innovation Sandbox for a paradigm shift in how organizations manage workload identity and access. Aembit positions itself as the "Okta for workloads," addressing a pervasive security gap that traditional user-centric identity and access management (IAM) solutions simply cannot fill.

The core problem Aembit seeks to solve is the inherent risk associated with long-lived credentials such as passwords and API keys, which are currently scattered throughout software environments. These secrets are notoriously difficult to manage, prone to leakage, and represent a significant attack vector. Goldschlag highlighted that with ten times more workloads than human users in modern enterprises, the potential risk surface is exponentially larger, demanding a purpose-built solution that moves beyond the manual, frustrating, and insecure practices of current secrets management.

Aembit's proposition is a secretless, identity-based, and policy-driven workload access control plane. By eliminating the need for static secrets and implementing a robust identity framework for workloads, Aembit aims to automate and secure access between applications across diverse environments, including cloud, data centers, and SaaS platforms. This approach not only enhances an organization's security posture but also streamlines operations, allowing businesses to automate authentication and authorization processes without requiring extensive code changes, marking a significant evolution in enterprise security.

Background

▶ Watch: The critical problem: securing software workload access (0:20)

The evolution of enterprise computing has led to an unprecedented proliferation of software workloads – applications, services, containers, serverless functions, and automated scripts – that constantly interact with each other and access sensitive resources. While significant advancements have been made in securing human user access over the past two decades through robust Identity and Access Management (IAM) systems, the equivalent for non-human identities has lagged critically. The industry has invested heavily in solutions like Okta for user identity, but the unique challenges presented by workloads have often been shoehorned into inadequate frameworks or left to ad-hoc, insecure practices.

The prevailing method for enabling workloads to access data and services relies heavily on long-lived credentials, such as API keys, database passwords, SSH keys, and service account credentials. These secrets are provisioned, stored, and managed across a complex tapestry of applications and infrastructure. The process is inherently fraught with difficulties:

• Provisioning: Initial setup of secrets can be complex and often requires manual intervention.
• Handoff: Securely transferring secrets between development, testing, and production environments is challenging.
• Rotation: Regular rotation of secrets is a critical security practice but is often neglected due to operational overhead, leading to stale, high-risk credentials.
• Reporting: Tracking the usage, lifecycle, and potential exposure of secrets is difficult, making auditing and compliance arduous.

This manual and fragmented approach to secrets management creates a significant attack surface. Secrets are frequently copied, stored locally in insecure locations (e.g., configuration files, environment variables, source code repositories), and reused across multiple services. When these secrets are leaked – whether through misconfiguration, insider threat, or external breach – they can grant attackers unfettered access to critical systems, often resulting in devastating data breaches and significant reputational damage, as highlighted by David Goldschlag's reference to ending up "on the front page of the newspaper."

Compounding this problem is the sheer scale of modern infrastructure. Goldschlag pointed out that there are "10 times more workloads than users." This statistic underscores the exponential increase in the number of identity-related risks when relying on secret-based authentication for automated processes. Furthermore, while Zero Trust security models have gained traction for user access, applying these principles to workload-to-workload communication presents a different set of challenges. As Goldschlag noted from his experience building one of the first user Zero Trust solutions, customers often inquired if it could secure application-to-application access. The answer was a definitive "no," because "workload access is a different problem, a different workflow, and a different tech stack." This fundamental distinction necessitates a purpose-built identity and access management system specifically designed for the unique requirements of workloads, moving beyond the limitations of traditional secrets management.

Key Findings

▶ Watch: Why user zero trust fails for workload access (2:00)

The central "key finding" presented by Aembit is the identification of a critical and underserved gap in the modern cybersecurity landscape: the secure and scalable management of workload identity and access. While enterprises have invested heavily in securing human users, the security paradigm for non-human workloads remains largely antiquated, relying on vulnerable, long-lived secrets. Aembit's founders, having previously built a user Zero Trust solution, directly observed that existing user-centric security models are fundamentally inadequate for securing inter-application communication, emphasizing that "workload access is a different problem, a different workflow, and a different tech stack."

This realization led to the core contribution: the development of Aembit Workload IAM, an identity and access management system purpose-built for workloads. The key findings and contributions can be summarized as:

1. Workload Identity as a Distinct Problem: Aembit's foundational insight is that workloads require their own dedicated identity and access management solution, separate from user IAM. The sheer volume (10 times more workloads than users) and the automated, programmatic nature of workload interactions demand a specialized approach that can scale and integrate seamlessly into CI/CD pipelines and cloud-native environments.
2. The Inherent Flaws of Secrets Management: The talk highlighted that current secrets management practices – involving provisioning, handoff, rotation, and reporting of long-lived credentials – are "frustrating and manual work" for both development and operations teams. This leads to common anti-patterns like secrets being copied, stored locally, reused, and inevitably leaked, creating significant security vulnerabilities. The finding is that these practices are not only inefficient but fundamentally insecure and unsustainable.
3. The Imperative for Secretless Access: Aembit's most significant contribution is its commitment to eliminating secrets entirely for workload authentication and authorization. By moving to a secretless model, Aembit directly addresses the root cause of many workload-related breaches. This shift fundamentally reduces the attack surface by removing static credentials that can be stolen, misused, or forgotten.
4. Identity-Based and Policy-Driven Control: The solution proposes an identity-based approach where workloads are treated as first-class citizens with unique, verifiable identities. Access is then granted and authorized based on granular, policy-driven rules, rather than the mere possession of a secret. This allows for dynamic, context-aware access control, aligning with Zero Trust principles for non-human entities.
5. Federated and Conditional Access: Aembit extends its identity-based approach to support two-sided identity federation, enabling secure access across heterogeneous environments including on-premises data centers, various cloud providers, and SaaS applications. Furthermore, the integration of conditional access capabilities, leveraging posture information from security tools like Wiz and CrowdStrike, adds an essential layer of dynamic risk assessment to workload access decisions.

In essence, Aembit's key findings underscore that the traditional approach to workload security is broken and unsustainable, and the path forward lies in a purpose-built, identity-centric, secretless, and policy-driven IAM system designed specifically for the unique demands of automated software.

Technical Deep Dive

▶ Watch: Aembit's solution: identity-based, policy-driven, secretless IAM (2:20)

Aembit's technical architecture is engineered to provide a secretless, identity-based, and policy-driven access control plane for workloads, effectively serving as an "Okta for workloads." The core innovation lies in abstracting away the need for long-lived credentials by establishing verifiable identities for every workload and enforcing access based on dynamic policies.

At its foundation, Aembit's job is twofold: first, to grant access based on policy, and second, to authorize access using secretless credentials. This approach fundamentally shifts the security model from "what secret do you have?" to "who are you, and what are you allowed to do?"

1. Identity-Based Workload Authentication:

Instead of relying on static API keys or passwords, Aembit establishes a cryptographically verifiable identity for each workload. This identity is typically tied to the workload's attributes, such as its running environment (e.g., Kubernetes pod, AWS EC2 instance, Azure VM), its code signature, or its organizational context. When a workload attempts to access a resource, it presents its identity to Aembit, which then verifies its authenticity. This is similar to how a user might authenticate with an identity provider using a strong authentication factor like an MFA token, but adapted for the machine-to-machine context. The specific mechanisms for establishing this initial trust and identity attestation are crucial and likely involve leveraging cloud provider identity primitives (e.g., AWS IAM roles, Azure Managed Identities, GCP Service Accounts) or platform-specific attestations (e.g., SPIFFE/SPIRE).

1. Secretless Credentials for Authorization:

Once a workload's identity is verified, Aembit issues short-lived, ephemeral credentials that are specific to the requested resource and the authorized policy. These are not traditional secrets that need to be stored, rotated, or managed by the workload itself. Instead, they are typically tokens (e.g., JSON Web Tokens - JWTs) that encapsulate the workload's identity and its authorized permissions for a very limited duration. These tokens are then used by the workload to access the target service or data. Because these credentials are short-lived and issued on demand, their exposure window is minimal, and they cannot be reused indefinitely if compromised, drastically reducing the attack surface compared to long-lived secrets. The workload doesn't "know" a secret; it merely receives and presents a temporary authorization assertion.

1. Policy-Driven Access Control:

Access decisions are not hardcoded but are governed by centrally managed, granular policies. These policies define which workloads are permitted to access which resources under what conditions. Policies can be written using a declarative language, allowing security teams to define rules such as "Service A can access Database X on Port Y" or "Application B can call API Z if it is running in Production environment." Aembit integrates these policies into the access decision process, ensuring that every request is evaluated against the defined rules before authorization is granted. The ability to "automate policy" suggests integration with Infrastructure as Code (IaC) tools and CI/CD pipelines, allowing policies to be managed like any other piece of infrastructure, promoting consistency and reducing manual errors.

1. Two-Sided Identity Federation:

Modern enterprises operate in hybrid and multi-cloud environments, often integrating with numerous SaaS applications. Aembit addresses this complexity through two-sided identity federation. This means Aembit can act as both an Identity Provider (IdP) for workloads within its managed domain and a Service Provider (SP) when workloads need to access external services.

• Federating Workload Identities: Aembit can federate identities across disparate environments – on-premises data centers, various public cloud providers (AWS, Azure, GCP), and even other SaaS platforms. This enables a unified identity context for workloads regardless of where they reside, eliminating the need for separate identity stores or complex trust relationships for each environment.
• Federating Access to Resources: Conversely, Aembit can integrate with target services (databases, APIs, message queues) to allow workloads to access them using their Aembit-verified identity and ephemeral credentials, even if those services are external or managed by third parties. This creates a seamless, secure access fabric across the entire distributed enterprise landscape.

1. Conditional Access using Posture:

Aembit enhances its access control capabilities with conditional access, integrating with leading security posture management tools like Wiz and CrowdStrike. This allows access decisions to be dynamic and risk-aware, factoring in the real-time security posture of the requesting workload or its environment. For example, a policy might dictate that a workload can only access sensitive data if it meets certain security criteria, such as having all critical patches applied, no known vulnerabilities, or being free from active threats detected by an endpoint detection and response (EDR) solution like CrowdStrike. If Wiz identifies a critical misconfiguration or a high-severity vulnerability in the workload's underlying infrastructure, Aembit can dynamically deny access until the issue is remediated, providing a powerful layer of defense-in-depth.

1. Automation and No-Code Integration:

Aembit emphasizes ease of deployment and operation, claiming it allows customers to "automate off without any code." This suggests that the solution provides agents or sidecars that can be deployed alongside workloads, or integrates directly with platform primitives (e.g., Kubernetes admission controllers, cloud service integrations) without requiring application developers to modify their code. This "no-code" approach is critical for rapid adoption and scaling across large, complex environments, minimizing friction for development teams while enhancing security.

In essence, Aembit is building a robust, intelligent control plane that orchestrates workload identities, evaluates policies, and issues just-in-time, ephemeral authorizations, fundamentally transforming how machine-to-machine access is secured in the modern enterprise.

Demo / Proof of Concept

▶ Watch: How Aembit works: secretless credentials and access authorization (2:35)

While the RSA Conference Innovation Sandbox presentation by David Goldschlag focused on a high-level overview of Aembit's vision, problem statement, and solution, it did not include a live technical demonstration or a detailed walkthrough of a Proof of Concept (PoC) in the provided transcript. The format of the Innovation Sandbox is typically geared towards a concise pitch rather than an in-depth technical demo.

However, based on the description of Aembit's capabilities, a typical demonstration or PoC would likely illustrate the following:

1. Onboarding a Workload: Showing how a new application or service (e.g., a containerized microservice, a serverless function, or a VM-based application) is registered with Aembit, establishing its verifiable identity without requiring the manual generation or configuration of any long-lived secrets. This would highlight the "automate off without any code" aspect.
2. Defining and Applying Policies: Demonstrating the creation of a granular access policy, perhaps using a declarative language, specifying what resources a particular workload (or group of workloads) is allowed to access. For example, "allow frontend-service to read from customer-database."
3. Secretless Access in Action: Illustrating how the onboarded workload, without possessing any static credentials, successfully authenticates with Aembit and then uses a short-lived, ephemeral credential (e.g., a JWT) to access a protected resource (e.g., a database, an API endpoint, a cloud storage bucket). The demo would emphasize the absence of traditional secrets in the workload's configuration.
4. Conditional Access Scenario: A more advanced PoC might show how Aembit integrates with a posture management tool like Wiz or CrowdStrike. For instance, demonstrating that if Wiz identifies a critical vulnerability in the workload's host, Aembit's policy engine dynamically denies access to sensitive resources until the vulnerability is remediated, showcasing the power of real-time conditional access.
5. Audit and Reporting: Highlighting Aembit's capabilities for logging and auditing all workload access attempts, providing visibility into who accessed what, when, and from where, which is crucial for compliance and incident response.

Such a demonstration would visually articulate the shift from manual, secret-dependent access to an automated, identity-based, and policy-driven framework, making tangible the benefits of Aembit's "Okta for workloads" vision.

Defensive Implications

▶ Watch: Key investors and go-to-market partners: Okta, CrowdStrike (3:35)

Aembit's approach to workload identity and access management carries profound implications for cybersecurity defenders, offering a strategic shift from reactive secrets management to proactive, identity-centric control. Organizations adopting Aembit's principles can significantly bolster their defensive posture across several key areas:

1. Elimination of a Major Attack Vector: The most significant defensive implication is the elimination of long-lived secrets as a primary target for attackers. By adopting a secretless authentication model, organizations remove the need for storing API keys, database passwords, and other static credentials in code, configuration files, or secrets vaults, which are frequent sources of breaches. This drastically reduces the attack surface and mitigates risks associated with secret leakage, theft, or compromise. Defenders no longer need to worry about the lifecycle management of these secrets, freeing up resources.

1. Enhanced Zero Trust for Workloads: Aembit enables true Zero Trust principles for machine-to-machine communication. Instead of trusting workloads based on network location or static credentials, access is granted only after verifying the workload's identity and evaluating its authorization against granular policies. This "never trust, always verify" approach ensures that even if an attacker gains a foothold within the network, unauthorized lateral movement is severely restricted because compromised workloads lack the necessary identity and authorization to access other resources.

1. Granular, Policy-Driven Access Control: The shift to identity-based, policy-driven access allows defenders to implement fine-grained control over what each workload can access. This moves beyond broad network segmentation or generic role-based access to context-aware policies that specify exact permissions based on workload identity, environment, and purpose. This precision minimizes the blast radius in case of a breach, as a compromised workload will only have access to the specific resources it is authorized for, adhering to the principle of least privilege.

1. Dynamic Conditional Access and Posture Enforcement: Integrating with security posture tools like Wiz and CrowdStrike provides a critical defensive layer. Defenders can enforce conditional access policies that dynamically assess the security health of a workload or its environment before granting access. This means if a workload is identified as vulnerable, misconfigured, or exhibiting suspicious behavior (e.g., by CrowdStrike), Aembit can automatically deny access to sensitive resources. This capability transforms static access rules into adaptive, risk-aware security gates, preventing compromised workloads from escalating privileges or causing further damage.

1. Simplified Secrets Management Operations: For Dev and Ops teams, Aembit simplifies what was previously a "frustrating and manual" process. This operational efficiency indirectly strengthens defense by reducing the likelihood of human error, misconfigurations, and neglected secret rotations that often lead to vulnerabilities. By automating policy and authentication, security teams can enforce consistent standards at scale without burdening development cycles.

1. Improved Auditability and Compliance: A centralized, identity-based access control plane provides a single source of truth for all workload access events. This significantly improves auditability, allowing defenders to track precisely which workload accessed what resource, when, and under what conditions. This granular logging is invaluable for incident response, forensic analysis, and demonstrating compliance with regulatory requirements (e.g., GDPR, HIPAA, SOC 2) by providing clear evidence of access controls and enforcement.

1. Unified Security Across Hybrid and Multi-Cloud Environments: Aembit's two-sided identity federation capabilities offer a unified security posture across disparate environments (on-prem, multiple clouds, SaaS). This eliminates the security headaches of managing fragmented identity systems and inconsistent access policies across different platforms, providing defenders with a consistent framework to secure workloads regardless of their deployment location.

In summary, Aembit empowers defenders to move beyond the reactive management of secrets to a proactive, automated, and intelligent system that secures workload access at its core, significantly reducing risk and improving overall security resilience.

Key Takeaways

• Secrets Management is a Critical and Broken Problem: The reliance on long-lived credentials (passwords, API keys) for workload access is inherently insecure, manual, and prone to leakage, posing a massive risk to businesses.
• Workload Identity Requires a Purpose-Built Solution: Workload access is fundamentally different from user access, with 10 times more workloads than users. User-centric Zero Trust solutions are insufficient, necessitating a dedicated, purpose-built Workload IAM system.
• Aembit Offers a Secretless, Identity-Based, Policy-Driven Approach: Aembit eliminates the need for long-lived secrets by establishing verifiable workload identities and granting access based on granular, centrally managed policies, authorized by short-lived, ephemeral credentials.
• Conditional Access Enhances Dynamic Security: By integrating with posture management solutions like Wiz and CrowdStrike, Aembit enables dynamic, risk-aware access decisions, allowing or denying access based on the real-time security posture of the workload or its environment.
• Automation and Federation are Key for Scalability: Aembit supports two-sided identity federation for unified security across hybrid, multi-cloud, and SaaS environments, and automates policy management without requiring code changes, ensuring scalability and operational efficiency.
• Reducing Attack Surface and Improving Compliance: By eliminating secrets, enforcing least privilege, and providing comprehensive audit trails, Aembit significantly reduces the attack surface for workload-related breaches and strengthens an organization's compliance posture.

About the Speaker(s)

The presentation was delivered by David Goldschlag, the Co-founder and CEO of Aembit. David Goldschlag, along with his co-founder Kevin Sapp, has a distinguished history in building software security companies, having worked together for 17 years. Their previous venture was focused on developing one of the first user zero trust solutions on the market. This background provided them with critical insights into the limitations of user-centric security for the unique challenges of workload access, leading to the inception of Aembit. Their expertise in the security industry is further underscored by Aembit's investors and go-to-market partners, which include prominent cybersecurity and identity companies like Okta and CrowdStrike.