Cryptography is the practice of protecting information by transforming it into a form that only authorised parties can read or verify. In security programmes, it covers encryption, integrity controls, and authentication mechanisms that protect data at rest, in transit, and during processing.
Expanded Definition
In NHI and IAM programmes, cryptography is the control layer that makes secrets usable safely, but only when key generation, storage, rotation, and revocation are governed with the same rigour as access policy. It covers encryption for confidentiality, hashing and MACs for integrity, and digital signatures or challenge-response mechanisms for authentication and non-repudiation.
For non-human identities, cryptography is not just about protecting data payloads. It also secures service account tokens, API keys, certificates, workload identities, and federation assertions across machine-to-machine flows. Industry usage is still evolving around where cryptography ends and identity control begins, especially in zero trust architectures where proof of identity, transport protection, and policy enforcement overlap. Guidance from the ISO/IEC 27001:2022 Information Security Management framework and operational guidance in the Ultimate Guide to NHIs both reinforce that cryptographic controls must be administered, not merely deployed.
The most common misapplication is treating encryption as a complete identity control, which occurs when teams encrypt data but leave keys, certificates, or tokens overprivileged, long-lived, or unmanaged.
Examples and Use Cases
Implementing cryptography rigorously often introduces operational overhead, requiring organisations to balance stronger assurance against key management complexity, latency, and rotation discipline.
- Mutual TLS between microservices uses certificates to authenticate both endpoints and encrypt traffic in transit, reducing token exposure when workloads communicate across segmented networks.
- API key hashing or vault-backed storage prevents plaintext credential reuse in source control, CI/CD systems, and ticketing workflows, a pattern highlighted in the Ultimate Guide to NHIs.
- Signed artifacts and signed agent instructions help verify that software or automation tasks were issued by a trusted authority, aligning with integrity expectations described in PCI DSS v4.0.
- Certificate rotation for workloads prevents stale trust from persisting after a compromise, especially when ephemeral agents are created and destroyed frequently.
- Encrypted backups protect service credentials and secrets at rest, but only if the backup keys are separately protected and revocation is tested.
In NHI environments, cryptography also underpins federation and workload identity patterns, where trust must extend across platforms without widening standing access. The right design depends on whether the secret is meant to be verified, transported, or temporarily delegated.
Why It Matters in NHI Security
Cryptography becomes a governance issue when organisations assume that a secret is safe because it is encrypted, while ignoring where keys live, who can decrypt them, and whether rotation is actually happening. That gap is especially dangerous for NHIs because service accounts and API keys are often embedded in automation paths that scale faster than human review. NHI Mgmt Group reports that 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage, and 96% store secrets outside dedicated secrets managers in vulnerable locations. Those conditions turn cryptography from a defensive control into a false sense of security unless it is paired with inventory, policy, and lifecycle enforcement in the Ultimate Guide to NHIs.
Standards like PCI DSS v4.0 focus attention on protection of authentication data, but NHI reality extends beyond payment environments into cloud workloads, agents, and automation. Organisations typically encounter cryptography failures only after a token leak, certificate abuse, or service compromise, at which point cryptographic governance becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Covers insecure secret handling and weak protection of machine identity credentials. |
| NIST CSF 2.0 | PR.DS-1 | Addresses data protection in transit and at rest through cryptographic safeguards. |
| NIST SP 800-63 | AAL2 | Relates to authenticator protection and assurance for credentials used in identity systems. |
| NIST Zero Trust (SP 800-207) | SC-23 | Zero trust depends on encrypted, authenticated communication between resources. |
| NIST AI RMF | AI systems rely on cryptography to secure model access, outputs, and provenance. |
Protect NHI credentials with strong cryptography, bounded exposure, and enforced rotation.
Related resources from NHI Mgmt Group
- How should organisations prepare IAM for post-quantum cryptography?
- How should security teams prepare APIs for post-quantum cryptography?
- Who should own trust telemetry when reporting spans NHI and cryptography controls?
- How should security teams prepare identity systems for post-quantum cryptography?
