I used to joke that I didn't have permission to do my job, but that comment made in jest was not that far from the truth. I was working in the highly regulated energy industry as a developer. The systems my code touched processed billions of dollars a month.
“We’ve got a critical issue in production. Can you see what's wrong?" I would hear this phrase every few months and shrug my shoulders as I responded, “Can you replicate the transaction causing problems in our test environment? I don’t have the access I need to debug it properly in production.”
I strongly disagreed with this heavily controlled approach at the time as I felt powerless to fix the issues in front of me, but over time, I began to understand the reasoning behind it. When money of that scale is on the line, reducing small amounts of risk at all costs—even when these critical minutes cost the company untold amounts of money—makes sense from the business perspective. The cost of potential failure surpassed the cost of delay.
... we aim to create that frictionless experience that developers crave...
Still, I longed for a world where I didn't have to sacrifice productivity for security. Here at Delinea, we aim to create that frictionless experience that developers crave while securing the developer identities that keep businesses innovating and thriving.
In this blog, you’ll learn how you can secure and manage developer identities—the humans in charge of development. As part of your security collaboration with developers, you’ll also want to consider the non-human, machine identities developers may create and leverage in their work.
Why are developer identities so risky?
Developer identities are human identities that typically have special privileges. Developers play a crucial role in managing and enhancing critical systems and infrastructure, making them an attractive target for attackers.
Among the four identity types in your identity attack surface, developer identities are the most nuanced because they share characteristics with the other three types. Like IT admins, they have a high level of privileges and technical skills. Like workforce identities, productivity is highly valued, and remote work and third parties are common practices. Now, add the fact that developers have access to and often create machine identities.
It’s a powerful combination of factors that should put developer identities at the top of your priority list.
Developer identities are tricky to secure for several reasons:
- Developers focus on efficiency to ship code and launch software quickly, which often takes precedence over secure behaviors. They don’t want to wait for approvals to have their privileges elevated. They would prefer standing privileges so they can work on their own time, whenever they want.
- As highly skilled technical experts, developers can be an independent bunch; they often use applications which may be unknown to central IT or find workarounds to established security processes.
- In addition to in-house teams of full-time employees, development is often outsourced to third parties, especially during times of heavy production or new initiatives. These teams access critical systems and sensitive data remotely. They tend to work in groups, which may result in sharing credentials or privileged accounts.
- Developers have access to sensitive data, often protected personal data and customer data. They work not only in production environments but also in development and test environments. Plus, developers also use third-party repositories like GitHub, where credentials can often be forgotten.
To have a comprehensive view of your risk exposure and close the gaps, security leaders need to consider the special needs of developers while incorporating this community into centrally managed processes.
How can you secure developer identities?
1. Discovery and inventory
With continuous discovery embedded in your identity security program, you can find and classify all privileged accounts and their related secrets, permissions, and MFA rules, across all on-premise, cloud, and application environments.
This ensures that all developer identities operating in your extended IT environment are accounted for, reducing the risk of unmanaged or orphaned accounts that could be exploited by malicious actors.
Because new identities and accounts are spun up and permissions change frequently, continuous discovery ensures you always have the latest information and status.
2. Protected credentials
Centralized credential vaulting and rotation avoid static secrets used by human and machine identities. Developers, including remote workers and third parties, should easily leverage the same encrypted enterprise-scale vault as the rest of the enterprise for dynamic password updates, addressing common vulnerabilities like static and shared credentials.
Be sure you can tie access rights and behavior to unique developer identities, rather than shared privileged accounts.
Centralized, enterprise vaults also support developer workflows by vaulting and managing credentials used by service accounts, machine identities and AI, including SSH keys, tokens, and certificates.
3. Privileged secure access
Ensure all developer-to-machine and machine-to-machine communications are authenticated and authorized with fine-grained access control, allowing only legitimate interactions to occur.
Context-aware multi-factor authentication (MFA) is an essential security control to safeguard developer identities. While MFA adds identity assurance against targeted attacks, developers can experience MFA fatigue—just like everyone else in your organization! By making MFA context-aware, you can choose when you want to add layers of protection for high-risk systems or activities.
Privileged secure access isn’t a set-it-and-forget-it approach, especially for developer identities. A developer may change projects often, requiring them to access different systems and data. These conditions make static access policies, even role-based access policies, inadequate. Instead of relying on fixed roles, intelligent authorization is dynamic and based on context, including changing behavior patterns and risk scores.
4. Embracing Zero Standing Privilege (ZSP)
This component of identity security ensures that developer identities operate with standard access until they require more. Instead of standing privileges, developers are granted elevated permissions using a just-in-time, just-enough approach.
By implementing zero standing privilege (ZSP), security best practices are maintained without hindering the creative and productive flow of developers.
Even if a developer identity is compromised, ZSP minimizes the blast radius and consequences because privilege escalation and lateral movement are limited.
5. Identity posture and threat analysis
As preventive controls, identity posture and threat analysis help you identify common identity misconfigurations, such as missing MFA, and understand the risk.
Also, auditing and monitoring developer identities, access, and behavior create an early warning system that gives you time to act before a small issue becomes a catastrophe.
By getting a baseline of typical developer behavior, you’ll be able to detect signals of potential compromise or insider threat, such as a developer accessing sensitive data at unusual times or creating a back-door account.
Threat detection can even tell you if an MFA bombing attack is sending requests over and over to one of your developers. Then, you can intervene before they accidentally accept a request and open the door to an attack.
You may choose to notify your security operations team so they can review threat signals with the appropriate context, or even enable automated actions such as enforcing additional layers of MFA or removing privileged access for a developer identity altogether.
6. Identity lifecycle governance
Manual provisioning, deprovisioning, and ongoing governance of developer identities are time-consuming and fraught with human error.
Automation streamlines processes for managing developer identities such as joiner-mover-leaver (JML) approvals and access reviews. This reduces administrative overhead and ensures compliance with security policies and regulations.
In addition, you can bring governance to automation workflows related to developers, including processes such as provisioning and deprovisioning accounts, injecting secrets, and managing changes like infrastructure-as-code.
Securing developer identities with the Delinea Platform
The Delinea Platform provides seamless, centralized authorization to manage developer access with intelligent, policy-driven controls.
Instead of siloed solutions run by different teams and disconnected data, you can secure developer identities and manage their access via the same platform as workforce, IT admin, and machine and AI identities. This means you can have comprehensive visibility of all identities operating in your environment and a holistic view of identity security risk.