The Venafi Trust Protection Platform was updated to version 21.1 on April 7, 2021.
If recent events have you looking at how you can better secure your software supply chain, the breach at SolarWinds and JetBrains announced in December 2020 should have you rethinking your strategy. This breach involved multiple security failures and occurred ‘left’, in the software build process. With more cloud native deployments and more reliance on DevOps, CI/CD pipelines, and build automation, securing machine identities for within the software development process is more important than ever. In the 21.1 release, Venafi introduces several features to help you secure your software supply chains.
Highlights from the Venafi 21.1 release are listed below. More details are available in the technical release notes and upgrade considerations article online.
Machine Identity Management Global Summit 2021 – Have You Registered?
Join Venafi customers near, far and “virtually” at our Machine Identity Management Global Summit 2021 on May 10-12! This year’s Summit promises to best yet with 75 Sessions, 6 Keynotes and 3 full days of Machine Identity Management best practices, learnings and collaboration. Get expert advice for TLS, code-signing, SSH, multi-cloud, IoT, DevOps and more. Join the lively roundtables, technical talks and featured “how-to” sessions, and get CPE credits for your attendance on the live days. For a sneak peek of the Agenda and to register for free, click here.
1. Adaptable Credentials
What Problem Does It Solve?
Customers want Venafi to integrate with the enterprise solution they use to store and manage all the passwords/secrets they maintain for the many systems and devices that need privileged access. Integration with these privileged access management solutions eliminates the need to manually setup and maintain credentials into the Venafi Platform, which is time consuming, error prone and inefficient.
How Does it Work?
Venafi builds and delivers software drivers designed to connect with many of the most common certificate authorities (CAs), application servers, enterprise monitoring systems for notification use cases and a driver to connect with the popular privileged access provider, CyberArk. But if the Venafi Driver Library does not include the driver you need, you can use a Venafi Adaptable Driver. In addition, because they are customizable, you can use an Adaptable driver in place of an existing driver to provide tighter integration between your business processes and Trust Protection Platform. In this case, the new Adaptable Credentials driver lets you integrate or customize the integration of the Trust Protection Platform with third-party credential management systems.
What’s the Benefit?
Security and Automation – Customers can now have the Trust Protection Platform automatically pull credentials from their existing privileged access management solution instead of manually entering them into the platform. In addition, when credentials are rotated in the privileged access management solution, there is no need to update the Trust Protection Platform with the newer version of the credential.
2. Adaptable Integration with HashiCorp Vault
What Problem Does It Solve?
Venafi customers leveraging HashiCorp Vault for storing secrets need products like TLS Protect to have access to those secrets.
How Does it Work?
This integration uses the new Adaptable Credentials driver to connect the Trust Protection Platform with HashiCorp Vault. The HashiCorp Vault script is available in the Venafi Marketplace https://marketplace.venafi.com/
What’s the Benefit?
Efficiency through Automation – In addition to enabling the Trust Protection Platform to automatically pull credentials from HashiCorp Vault, this integration offers a useful guide for customers wanting to use Adaptable Credentials with other credential management solutions.
3. Inline Placement of Keys and Certificates During Discovery
What Problem Does It Solve?
Venafi customers that are discovering large numbers of keys and certificates and then using placement rules to organize them in folders might find performance affected by other jobs running on the Venafi Platform.
How Does it Work?
Certificate and SSH key placement now happens inline, with minimal latency, immediately after being discovered. In addition, the certificate reconciliation algorithm is improved so that it places less load on the CPU and database, allowing discovery and placement of keys and certificates to be completed in less time.
What’s the Benefit?
Performance – Discovery and placement of keys and certificates is faster, more predictable, and more efficient.
4. Session Management Control
What Problem Does It Solve?
Customers want the flexibility to change the default timeout value of their Venafi session and warning when the session is about to timeout. The warning is also a requirement for customers who need to use solutions that are accessible and section 508 compliant.
How Does it Work?
With the 21.1 release, Venafi customers can now change the default session time out value and maintain that value as they upgrade to future releases (in previous releases, the timeout value would reset to the default each release). In addition, users now get a warning when the session is going to expire and are given the ability to extend the session.
What’s the Benefit?
Usability – Users won’t unexpectedly be logged out of the Venafi Platform.
Additional Trust Protection Platform Capabilities – See the technical release notes and upgrade considerations article for more detail on these capabilities as well as other new Venafi Platform features.
1. Time Stamping Enforcement
What Problem Does It Solve?
Time-stamped code signing signatures are imperative to ensure that code-signed applications continue to run even if the code signing certificate has expired. While it is relatively easy to specify this option within the code signing tool being used, many people forget to do that. The result is that important production software will stop working in the future, when the code signing certificate expires.
How Does it Work?
Previous releases of CodeSign Protect product provided support for time stamping services such as a standalone time stamp server or a proxy to a public timestamping service. However, there was no way for a code signing administrator to require that developers include options such as time stamping. In this release, a code signing administrator can now configure an environment template that will require timestamping options be used when signing code.
What’s the Benefit?
Automation & Security – Through process automation, time stamping can be configured to be required and automatically enforced. The benefit if you opt to require this is that developers will be forced to timestamp their applications when they code sign them.
2. Application Container Signing
What Problem Does It Solve?
Application containers, such as Kubernetes or Docker images, are pieces of code that execute. As with any piece of code, it is important to digitally sign (code sign) to show the authenticity of the author and demonstrate that they have not been modified after they were signed. Tools such as podmap and skopeo offer signing capabilities but they do not provide private key protection, auditing of signing operations, automation of enforcement of signing workflows, or visibility into what has been signed and by whom.
How Does it Work?
Venafi CodeSign Protect integrates with mainstream container signing tools such as podman and skopeo.
What’s the Benefit?
Automation & Security – Without needing to modify build scripts, users can continue to use tools like podman & skopeo to continue signing their containers while CodeSign Protect automatically enforces any workflow requirements, audits the process, and at the same time protects the private keys that are needed for these signing operations.
3. High Assurance Signing – Pre-qualified Signatures
What Problem Does It Solve?
Today, customers may use vulnerability scanning tools to ensure that they software that they use is safe for their users to use. However, after running these scans, if the software is not digitally signed, then it is impossible for others to know if the software hasn’t been modified (such as malware insertion) after it was scanned for vulnerabilities.
How Does it Work?
Venafi CodeSign Protect now provides APIs that allow users, after they have scanned their software (or other artifact), to generate a hash of the software/artifacts, and then store these approved/known hashes into Venafi CodeSign Protect prior to signing. When CodeSign Protect is called to sign these applications, it will verify that the hash of the application matches the approved and stored hash value. If it doesn’t, it will not sign the application/artifact.
What’s the Benefit?
Security – For organizations wishing to secure their software supply chain, this feature provides high assurance by signing only applications that have been previously scanned.
4. Sensitive Configuration Control (M-of-N)
What Problem Does It Solve?
Certain sensitive operations (such as a deletion of a private code signing key) should require multiple approvals to ensure that the operation is not accidentally performed, or perhaps performed with ill intentions in mind.
How Does it Work?
Venafi CodeSign Protect now enables a configurable option that requires multiple approvers for performing certain code signing operations or project activities (such as deleting a key or project).
What’s the Benefit?
Security – Protects against intentional and incidental actions when deleting keys and projects.
5. Benchmark Tool
What Problem Does It Solve?
Administrators of Venafi CodeSign Protect sometimes need the ability to benchmark capacity and performance requirements for their code signing stakeholders. Without a benchmarking tool, this is difficult to achieve.
How Does it Work?
Venafi CodeSign Protect introduces the capability for customers to be able to measure latency and performance of all necessary code signing operations.
What’s the Benefit?
Performance – This benchmarking capability enables customers to perform better capacity planning, performance tuning, and increase their confidence in their deployment configurations.
Additional CodeSign Protect Capabilities – See the technical release notes and upgrade considerations article for more detail on these capabilities as well as other new Venafi Platform.
While separate from the Venafi 21.1 release, several Venafi Ecosystem Partners have recently introduced products and updates that might complement your current use of the Venafi Platform and products.
These include:
Citrix ADM
Citrix and Venafi now offer an out-of-the-box, tightly integrated solution that enables Citrix ADM to fully automate requests and renewals of keys and certificates from TPP, securing machine identities across ADCs and prevent certificate-related downtime and outages. Learn more
F5 Silverline
HTTPS encryption is more prevalent than ever but can be difficult to scale. F5 Silverline and Venafi have teamed up to make it easy to automate the use of enterprise-compliant machine identities for application teams. Learn more
Gigamon GigaVue-OS
This Gigamon/Venafi integration provides intelligent orchestration and management of machine identities for Gigamon appliance web management interfaces. Learn more
Connector for Venafi & Jira Service Management (JSM)
Available on the Atlassian Marketplace, the Connector for Venafi & JSM is an out-of-the-box integration that automates Venafi and Jira workflows to give your teams a self-service certificate management tool that ensures your machine identities stay secured. Learn more