Security professionals across industries (you likely included) agree on at least one thing: SSH key management is a real problem. It’s a massive time sink that keeps security and infrastructure teams from achieving maximum productivity, and management challenges open the door to security risks.
Good news: There is an easier, more secure and more scalable way to leverage SSH. BastionZero’s technology eliminates SSH keys and supports least privilege access without impacting the user experience. Here’s why it’s time to modernize your security architecture if you’re using SSH.
SSH Key Management Is More Than a Frustration. It’s a Liability.
Managing SSH keys is a drag. Administrators my be required to issue, rotate and invalidate SSH keys, which is a difficult process to maintain especially as organizations grow, are reorganized and employees leave. Many enterprises have thousands of SSH targets, which makes key management a major hassle that can rob security and infrastructure teams of the time and energy they need to complete other important tasks.
But the real problem is that SSH has some security issues of its own. It’s often difficult to see who is logged in to an SSH target and what commands are being executed. SSH can also complicate the best practice of least privilege, which demands that keys should be revoked once they are no longer needed. The complexity of storing and deploying keys can make it a challenge to revoke keys, affording users access to SSH targets longer than is necessary. And just-in-time access, where credentials are given only at the exact moment they’re needed, is at odds with the task of working through a bulky and cumbersome SSH key system.
In theory, privileged access management (PAM) can provide employees with time-based SSH keys, but revoking access can be difficult. You can move your infrastructure access function to a cloud service to simplify the process, but this usually means you have to trust a third party with sensitive credentials, which creates a risky single root of trust.
Consider An Alternative to SSH Key Management
BastionZero provides zero trust access to infrastructure while eliminating the time and security concerns of SSH key management. We can handle that process from our cloud — and there’s a critical difference compared to other services that makes working with us drastically more secure. Our core protocol allows users access only if they get cleared by two authorities: BastionZero and a single sign-on (SSO) or identity provider. Even if one of the two is breached, fraudulent users can’t gain access. And with SOC 2 certifications, we have a proven capability to keep data safe.
Our technology can live side-by-side with your existing SSH system and even take on the responsibility of SSH key management. Setup is straightforward, including auto-integration with most SSO providers and auto-discovery of your infrastructure targets. You deploy the BastionZero agent, install the Zero-trust Desktop App or Command Line Interface (ZLI), and create an access policy to control user permissions. You can even track activity by username, which makes auditing straightforward. And by streamlining the management process, our technology helps you provide and revoke keys at any time, which facilitates adherence to least privilege principles and supports providing just-in-time access.
From your users’ perspective, not much changes. While they will need to install the ZLI or our desktop app, they can otherwise use SSH keys the same way they always have. Behind-the-scenes, there is a change: BastionZero’s access policy enables precise control over what targets each user can access — even if you have thousands — so the risk of unauthorized lateral access to other targets is eliminated.
Companies Deserve a Better Way to Handle SSH
The tremendous amount of time that security professionals have poured into SSH key management is a testament to these experts’ work ethic and drive. Yet this effort results in lower productivity and the risk of being overwhelmed by complexity while security liabilities sneak through. Your organization deserves a zero trust infrastructure access solution that respects your time without forcing your security to be at the mercy of a single third party. And you deserve the ability to easily achieve best security practices, maintain visibility into user activity, and keep disruption to a minimum. That’s what BastionZero can provide.
