Every story tagged KEY Management, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
4 stories · open in the command center
Coldkey addresses a critical vulnerability in cryptographic key management by enabling post-quantum secure key generation and offline paper backup for age encryption keys, protecting organizations from both quantum computing threats and digital infrastructure failures. For IT leaders managing secrets at scale (via SOPS or similar tools), this tool transforms key loss from a catastrophic permanent data access failure into a recoverable scenario through printable, QR-coded backups stored in physical vaults. The post-quantum cryptography (ML-KEM-768) ensures current encryption investments remain secure against future quantum threats, while the container-based implementation with hardened security controls makes it suitable for regulated environments requiring demonstrable key protection mechanisms.
Kloak is an agentless Kubernetes security solution that uses eBPF to intercept HTTPS traffic and replace secret placeholders with actual credentials at the network edge, ensuring applications never directly access sensitive data and eliminating a major attack surface for credential theft. This approach delivers enterprise-grade secret management without code changes, sidecar overhead, or latency impact, while maintaining compatibility with standard Kubernetes Secrets and requiring only simple YAML labels for enablement. For IT organizations, Kloak reduces operational complexity and security risk by shifting secrets enforcement from application-layer to kernel-layer, significantly lowering the blast radius of compromised workloads.
Long-lived cryptographic keys pose compounding security risks over time and should be systematically replaced with ephemeral credentials wherever possible—such as temporary SSH keys via EC2 Instance Connect, short-lived PyPI tokens via trusted publishers, and SSO assertions—to reduce operational burden and attack surface. While some long-lived keys are unavoidable, organizations should consolidate these high-risk assets into dedicated, heavily-monitored infrastructure, establish clear maximum lifetime policies, and rotate quarterly to maintain security posture and reduce incident risk. This shift from distributed, static credentials to ephemeral, dynamically-generated ones represents one of the highest-ROI security engineering investments, simultaneously improving both security resilience and operational maintainability.
Modern TPM chips present in most enterprise hardware (required for Windows 11) can store SSH private keys as an alternative to traditional file-based storage or dedicated hardware security modules like Yubikeys. While TPM-based storage offers stronger security than filesystem keys by preventing malware extraction and keeping keys out of memory, it provides less protection than portable HSMs since TPM chips are device-bound and may lose data during BIOS updates. This approach enables organizations to leverage existing hardware for improved SSH key security without additional token procurement costs, though backup strategies become critical given TPM data persistence limitations.