Agent-based AAPM offers a secure and flexible solution for delivering, rotating, and consuming secrets using a locally deployed agent. The Secure Agent acts as an essential intermediary in environments where direct integration via API is not feasible, such as air-gapped networks, DMZs, or highly segmented networks, enabling the retrieval and management of credentials with full traceability.
The agent ensures that applications, services, and scripts always use up-to-date secrets, enforces Just-In-Time (JIT) access, and can operate without continuous privileges when necessary, significantly increasing security.
Key Features
- Local agent deployment: lightweight, cross-platform agent that supports Windows, Linux, and containers.
- Secure communication with the vault: a secure, encrypted, and mutually authenticated channel with the Secure vault.
- Just-In-Time (JIT) credential delivery: credentials are only available at runtime, never stored persistently.
- Automatic rotation and renewal: the agent automatically fetches new credentials when it detects a change or expiration.
- Offline/isolated mode: works in environments without an internet connection or segmented environments; has optional secure caching.
- Auditing and compliance: all agent actions are logged and available to SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) systems.
Use Cases
- Legacy Applications in DMZ: secure delivery of credentials to applications in restricted network segments where direct API calls are not allowed.
- Isolated/Industrial Environments: credential rotation for SCADA/OT, IoT, and industrial devices through the agent.
- CI/CD and Automation: injection of secrets into build scripts/deployment tools using agent hooks.
- Critical Infrastructure: application of credential rotation and elimination of hard-coded secrets on critical servers.
Agent Functions
Registration and Authentication
- The agent registers and authenticates with the Segura vault.
- The authentication process may involve tokens, certificates, or mutual authentication.
Credential/Secret Request
- Applications and scripts request secrets through the agent's local API or CLI (Command Line Interface).
- The response includes credentials that are immediately usable and disposable after use.
Credential Rotation Triggers
- The agent supports scheduled, on-demand, or event-driven credential rotation.
- Configure rotation policies to meet specific security requirements.
Secure caching (optional)
- The agent can temporarily cache secrets with strict TTL (Time-To-Live) and memory protection.
- Caching improves performance by minimizing frequent calls to the vault while maintaining a high level of security.
Configuration and deployment
Preparing the environment
- System requirements check: confirm that the host supports running the Segura agent.
- Agent installation: follow the specific installation instructions for your platform (Windows, Linux, or container).
Agent configuration
- Authentication: configure the agent's authentication method with the Segura vault.
- Local endpoints: define the local endpoints so that applications can request secrets.
- Caching policy: If you choose to use caching, set the TTL policy according to your organization's security needs.
Integration with applications and scripts
- Local API: show how applications can make local HTTP requests to obtain credentials.
- CLI: provide clear examples of how to integrate the agent CLI into automation scripts.
Rotation and auditing
- Rotation events: configure and test rotation events to ensure credentials are continuously updated.
- Audit logs: access and review logs generated by the agent for monitoring and compliance.
Best Practices
- Token security: store and manage authentication tokens securely, preferably in a protected location.
- Integration testing: perform integration testing in development environments before deploying to production.
- Continuous monitoring: regularly monitor audit logs to detect any abnormal behavior.
- Updates and patches: keep the Segura agent up to date with the latest versions and security patches.