Just-In-Time Access (Ephemeral Credentials)

Which company hasn’t ever found itself needing to grant access to a user for just a day or a few hours? 

Access of which is from a third party or partner who needs specific information or system maintenance that results in the creation of another user for access to the environment, which after a few hours will never be used again.

This increases the risk possibilities as there are more users with certain privileges to be exploited. 

One thing is undeniable: specific and temporary access is needed; the problem is understanding how to control them. 

This article aims to introduce “Just-In-Time-Access” from the very beginning of the concept, how it works and how it can be applied so that your organization’s privileged access becomes more secure.

But first, what is Just-In-Time?

Known as a management philosophy, Just-In-Time (JIT) emerged in Japan in the 1970s at Toyota Motors, which wanted to create a system that would increase vehicle production efficiency for a specific demand of colors and models. 

The main goal of this concept is to avoid waste through “pull” production, which in practice means that only the number required will be produced in the time required. 

This practice resulted in inventories with smaller quantities of materials, which would be used as best as possible, avoiding waste. 

In short, this philosophy dictates that products must be produced and delivered on time for immediate use, that is, production meets only what was required by demand. 

There is no storage of products in inventory for when there is demand, as this can never happen because the organization would have to invest more money to keep them. 

Another point is that products in inventory, pending demand, may become obsolete. The only option, therefore, would be to discard them by throwing away much of the time and money investment altogether.

Just-In-Time-Access

This production management philosophy can also be applied to managing access to systems and organizational environments. In other words, to enable timely access for immediate use, after which access will be blocked. 

Thus, the idea of temporary credentials arose. They are called “Ephemeral Credentials” because they cannot be used again when they expire, which is equivalent to the period of time for the access requested.  

It would be like creating a key that opens only one door at a given time, after which the lock changes and another key would be required to enter the room. 

This practice makes access to systems more secure, as the access credential has a small lifespan. Therefore, if it is stolen or intercepted, an attacker will not have enough time to take any malicious action, not to mention the limited access they would have to some privileges. 

It also makes it easier for system administrators to enable and revoke privileges for many users who need to access specific information for just a few hours. 

If the administrator forgets to revoke one of these accesses, these privileges can be exploited by attackers or even the employee who knows the credential data. 

It is like saying, for example, that there are a limited number of keys to access the various parts of an organization, and these keys cannot be found anywhere, let alone manufactured by anyone. To enter the desired room, the user has to wait for the key to arrive, and be asked to leave when the time is up, and after leaving, the key simply self-destructs, making it impossible for anyone to reuse it.

In practice, how does it work?

First, the user who wants to perform some privileged action or even a simple action (if the model is implemented in addition to privileged access) needs to make an access request. 

This user will have to justify their access and specify the time that will be required to perform the action and wait for access approval to be granted. Of course, privileges and activity time can already be set by the administrator, providing only the time and privileges believed to be needed. 

Upon approval of the requested access, the user will receive the ephemeral credentials and their period of time for expiration and will be duly informed about the activities they can perform and the time that the credential will be enabled. 

By the end of the access time, the credentials will be blocked or even deleted, according to the administrator’s preference. If activity is not completed within the period of time granted for access, the user will have to make a new request. 

Even with the credential blocked or deleted, it is extremely important to keep the logs of this access for control and security of operations. 

This will allow the user to no longer have access even if they remember the credential data, as the system will not authenticate them as a valid user due to the expiration of their access. 

Like JIT in Just-In-Time Access, ephemeral credentials are created with on-demand privileges to be used immediately, in due time. There is no “inventory” of privileged credentials to be distributed when requested. 

It is worth to mention that the more stored credentials, the more access keys an attacker can obtain and, consequently, they will be able to access any “room” of the organization.

Make Just-In-Time Access into Reality

As said, enabling and revoking access is a daunting task for any system administrator, but with Just-In-Time Access, wouldn’t it be like complicating this work? The volume of privilege revocation and credential blocking would be much higher and errors would be almost inevitable. 

So how do you make Just In Time Access an applicable reality into your organization? A tool that automates this process is the solution. 

You probably already know about Privileged Access Management (PAM) technology, and if you don’t, it is a technology that controls and manages privileged access to critical information in an organization. 

This type of technology allows Just-In-Time Access to be adopted in access control, as it allows controlling access requests and auditing all activities performed. It is also able to define the level of privilege for each credential and deliver them exactly to the users who need this access.

Some benefits we can mention when automating Just-In-Time Access through PAM technology are: 

• Delivery of ephemeral credentials securely, such as emailing directly to the user who will use them.
• Revocation of all ephemeral credentials after the specified time
• Automation of the access creation and privilege provisioning process.

By using senhasegura, which is a PAM solution, organizations can reduce their credential inventories, create provisions for specific time periods, obtain detailed access log records, and record sessions with credentials assigned.

With ephemeral credentials or not, your organization needs to protect the keys of the kingdom, which are privileged credentials. 

Contact us and learn how senhasegura can do it for you.