Machine identity

A machine identity is a cryptographic credential or certificate that identifies a non-human entity - like a server, container, IoT device, or API client - to other systems. Machine identities allow automated processes to authenticate and establish trust. 

For instance, a server uses TLS certificates to prove it’s the legitimate host for a domain, or a container obtains a token to access an API. Managing machine identities includes issuing, rotating, and revoking certificates/keys to maintain secure communications among machines.

It is important to note that all machine identities are non-human identities, but not all non-human identities are machine identities. Non-human identities also include service accounts, APIs, and bots that aren't tied to a specific machine.

How does it affect identity security?

Zero trust frameworks treat machines as untrusted by default, requiring each machine identity to authenticate (e.g., mTLS) when communicating. Automated certificate management solutions integrate with cloud services to unify human and machine IAM. Comprehensive logs let security teams quickly revoke or replace any compromised machine identity across the environment.

If attackers compromise a machine identity, they can impersonate that system and decrypt or modify data. A compromised TLS certificate could let attackers run phishing sites with a valid certificate or eavesdrop on traffic. Expired certificates can cause outages or force insecure fallback connections. Thus, robust machine identity management ensures that all certificates and keys are tracked, properly secured (e.g., in HSMs or vaults), and frequently rotated. This reduces the chance an attacker can exploit a stale or stolen credential to infiltrate systems.

Case study

The ProxyLogon vulnerabilities allowed attackers to impersonate legitimate Exchange servers, partly by abusing validation steps for server certificates. This granted unauthorized mailbox access across thousands of organizations. Proper machine identity protections (strict certificate pinning, robust patching) might have lessened the attack’s scope.

‍