ARCON Digital Vault

Managing access for non-human entities has shifted from a niche concern around service accounts and hardcoded credentials to a central cybersecurity challenge driven by APIs, cloud-native architectures, and automated workloads. The focus is now on protecting and governing “secrets” (tokens, keys, certificates, and credentials) used by non-interactive identities (NIIs), defined as pre-defined, monitorable sessions where any interactive behavior could indicate compromise. As organizations moved from monolithic cloud migrations to containerized microservices, the benefits of agility and cost-efficient scaling increased, but so did the security and governance burden—especially in multi-cloud environments where relying on a single provider’s security stack is insufficient.

ARCON’s Digital Vault, built on its Privileged Access Management (PAM) background, aims to centralize and automate secrets and identity control for both human and non-interactive identities. It uses discovery capabilities from connected platforms to identify secrets for vaulting, supports manual and automated credential rotation, and offers broad integrations (including AWS CloudFormation, Jenkins, Puppet, Ansible, Kubernetes, Terraform, and Chef). Example patterns include short-lived build-time tokens for CI/CD pipelines and Kubernetes sidecars that authenticate to the Vault, with validation designed to favor dynamic credentials over persistent tokens.

The solution emphasizes unified visibility and governance through a single dashboard: credential policy and rotation workflows (including pre/post-rotation actions), onboarding assets, creating and restricting NIIs (e.g., by IP/MAC), activity logging, MFA enablement, and identity governance campaigns. Strengths include managing diverse secret types across multiple environments, reducing “vault sprawl,” and enabling automation that improves posture and reduces manual maintenance—particularly for distributed assets. Key challenges include PKI chain-of-trust certificate management complexity and achieving consistent practices across varied environments, with subscription licensing priced per credential and deployment available as SaaS or customer-hosted.

• Non-interactive identities often use secure API access requiring secure tokens rather than dedicated service accounts.
• Secrets requiring protection include web-app tokens, service account keys, AWS keys, Azure service principals, TCP keys, SSH keys, and database credentials.
• ARCON maintains over 400 connectors to major infrastructure providers.
• SDKs are available for AWS CloudFormation, Jenkins, Puppet, Ansible, Kubernetes, AWS OpsWorks, Terraform, and Chef.
• A Jenkins vault broker can fetch credentials at build-time using a short-lived authentication token for pipeline events.
• In Kubernetes, a sidecar can authenticate to the vault using shared memory or Kubernetes secrets in the application pod.
• More than 50 pre- and post-rotation actions are available out-of-the-box for credential rotation workflows.
• The solution can act as an internal certificate authority and issue certificates to target devices such as an F5 load balancer.
• Built-in governance reviews can be conducted on orphaned accounts or owned accounts.
• The Digital Vault can be deployed as SaaS on AWS, Azure, Google Cloud, and Oracle Cloud Infrastructure, or deployed by clients in their own data center/private cloud, with subscription licensing priced per credential.

• “Managing computer system access for non-human identities has changed dramatically over the past few years and the management of ‘secrets’ has been thrust into the focus of cyber-security professionals.”
• “Rather than non-human identity, in this document we will use the term ‘non-interactive identity’ (NII) to better describe a session that initiates a pre-defined activity that can be monitored to ensure that interactive use, which would indicate a compromise, is not occurring.”
• “The flexibility and cost advantages of cloud-native application deployment are compelling; but the security and governance tasks are considerable.”
• “Without such guidance the corporate environment will be driven by staff making their own decisions as they connect things to the corporate network, and the whims of developers selecting their preferred tools.”
• “The management imperative in most organizations is to get control of the rapidly increasing number of non-interactive identities.”
• “The mission of ARCON is to automate the control of access to protected resources within an organization.”
• “The real-time management of credentials encourages developers to take an API-first approach that avoids coding secrets into interfaces and reduces the fractured authentication environment that many organizations experience.”
• “As cloud technology continues its rapid development, particularly in cloud native environments, the management functionality afforded by the Digital Vault is no longer optional.”
• “To enroll a machine or workload it is necessary to identify its ownership and the desired credential type (could be of any arbitrary nature).”
• “The solution will not replace the SOC/SIEM tools that organizations will continue to operate but it will enhance management’s ability to monitor the digital asset environment and credential usage for those systems.”