Business

As social engineering and phishing attacks become more prevalent, it's clear that a shift away from legacy forms of authentication is necessary. Learn about alternative phishing-resistant authentication methods you can adopt to better protect your organization.

Why passwords and OTPs suck

With phishing attacks on the rise, passwords are no longer a reliable method for granting infrastructure access or authenticating users. It is time to adopt authentication methods that don't rely on shared secrets.

On-demand SSH certificates with Indent + Smallstep

By Jenessa Petersen

Get into all your hosts quickly and reduce the toil of manually finding and renewing SSH keys with Smallstep SSH Professional. Combine that with Indent’s time-bound, on-demand access and you have better security in minutes.

4 Reasons Customers Use Smallstep SSH Professional

By Jenessa Petersen

Here are some of the (many, many) reasons our customers trust and use Smallstep for SSH.

5 Infrastructure Security Advancements You May Have Missed in 2022

Apple MDA, GitHub OIDC, systemd-creds, Passkeys, and Identity-Aware Proxies: Here's a look at some infrastructure security advancements that caught our attention in 2022.

Never DIY Your PKI

By J. Hunter Hawke

A good PKI is essential for most organizations’ security models. However, building one from scratch is much easier said than done. Don't build your own PKI. Take it from me; I tried to, and this is my (horror) story.

3 Reasons Why You Shouldn't Use Public CAs for Internal Infrastructures

Public web certificate authorities like Let's Encrypt were not designed to support internal use cases. What you need is a private certificate authority.

Introducing Advanced Authorities

By J. Hunter Hawke

Learn the differences between our Devops and Advanced Authorities offerings

How we got here, and where we are headed

We have secured our seed and Series A funding - this is a huge thank you to our investors and our community who believe in us and continue to help us make Production Identity a reality.

Cheating my way to success

By Carl Tashian

As I round the bend on two years at Smallstep, I have to ask myself: Why is this going so well?

2020 Certificate Management Survey Results

Internal PKI continues to be essential but struggles with modern practices. But don't worry, there is hope.

🤦‍♂️ Facepalm Lesson One: The Delayed Aha Moment

What became clear in our product-led research is that we made a few mishaps. And there was one in particular that we wanted to fix ASAP. A series of go-to-market learnings and mishaps from smallstep.

Smallstep SSH

It took a lot of late nights and weekends to get here. I’m incredibly thankful for the work of our fantastic team, early access customers, and to their families for behind the scenes support. Today, we’re excited to announce the output of that work: the general availability of Smallstep SSH Professional Edition.

BSidesSF 2020 - If You're Not Using SSH Certificates You're Doing SSH Wrong

Video recording of the 10-minute lightning talk from Mike Malone on using SSH Certificates. This was recorded at BSidesSF 2020.

Prove you are not human -- Take the ACME Challenge

Automating internet security with the Let’s Encrypt certificate authority has led to the massive acceleration of safe web browsing. As we roll out ACME protocol support and give away some free hoodies, we want to thank Let’s Encrypt and the IETF for making it all possible.

Trust Anchors In Modern Systems; Don’t Overlook The Bottom Turtle

This issue is a discussion about the trust anchor and dependencies of systems. While a clever turtle reference often satisfies the room, getting a real answer to this question is fundamental to modern security practices.

Great Minds Really Do Think Alike! No really, they do!

Great Minds Really Do Think Alike! I found an inarguable topic in the most unlikely of places, deep in the conversations between cyber-security experts.

Traffic, Bridge Tolls, and Secure Browsing - How Automation Secures The Internet

In this post, we will explore how successful public internet practices provide a set of instructions for how the industry should be thinking about securing internal systems. The second edition of the Modern Security for Leaders series.

Instincts, Fast Cars, and Modern Security - Why I Joined smallstep

smallstep’s vision is centered on modernizing security practices using the best available technology to solve security challenges. Now you’re probably saying (as I was at this point), there are hundreds of companies out there spending billions of dollars on modernizing practices. How much market is really left for a scrappy startup? Turns out a lot!

The case for using TLS everywhere

This post has a simple purpose: to persuade you to use TLS everywhere. By everywhere, I mean everywhere. Not just for the public internet, but for every internal service-to-service request. Not just between clouds or regions. Everywhere. Even inside production perimeters like VPCs. I suspect this will elicit a range of reactions from apathy to animosity. Regardless, read on.

Step: A New Zero Trust Swiss Army Knife from Smallstep