# Security, Secrets and PKI

> Envelope encryption and KMS control, certificate rotation, secrets sprawl, supply-chain signing, and what the CrowdStrike incident teaches about EDR.

- Web page: https://www.alesanalytics.com/architecture/security
- Markdown: https://www.alesanalytics.com/architecture/security.md
- Part of: [Enterprise Architecture Atlas](https://www.alesanalytics.com/architecture.md), section "Cloud platforms"
- Last verified: 13 October 2026
- Publisher: Ales Analytics

## The question security answers

Security is about what an attacker can reach after they get one foothold. Not whether they get in (assume someone eventually does) but what the identity, the file or the key they now hold lets them do next.

So the question to ask of any design is: **if an attacker holds this identity, or this file, what can they reach next?**

## The vocabulary

Threat model. Attack path. Privilege escalation. Secret. The key hierarchy: a root key protects key-encryption keys, which protect data-encryption keys. KMS and HSMs. PKI: an offline root CA, issuing CAs below it, and leaf certificates. SBOMs, provenance and signing for the software supply chain. EDR on endpoints and servers. Network segmentation.

## Mechanisms worth understanding

**Envelope encryption puts the KMS key policy in charge of the data.** Data is encrypted with a data key, and the data key is encrypted with a KMS key. Whoever controls the KMS key policy controls the data, whatever the storage permissions say. That is why the atlas lists KMS in the Tier-0 set, and why "encryption equals security" is on the [misconceptions page](https://www.alesanalytics.com/architecture/misconceptions.md): encryption only helps if the key is controlled by someone other than the attacker.

**Certificate rotation needs overlap, and expiry is a synchronised failure.** Every client checks validity against the same moment, so an expired certificate fails everything that depends on it at once. Managed certificates and ACME automation exist because people forget.

**Secrets sprawl.** CI variables, notebooks, agent configuration files, tickets and chat messages are where long-lived secrets end up. The fix is to have fewer of them: workload identity in place of keys wherever the platform supports it.

**Email and calendar content is an injection channel into AI.** Anything an assistant reads can carry instructions. That's the first item in the OWASP list for agentic applications, covered on the [retrieval and agents page](https://www.alesanalytics.com/architecture/ai-retrieval-and-agents.md).

**Endpoint management feeds access decisions.** An Intune-class device-management system reports whether a device is compliant, and Conditional Access uses that to decide whether to let it in.

## Architecture that holds up

- Tiered administration, with privileged access management and just-in-time elevation.
- A vault with short-lived, dynamically issued secrets.
- Workload identity instead of secrets wherever possible.
- A signed software supply chain, from source to registry to deployment.
- Egress control, so a compromised workload can't send data anywhere it likes.
- Immutable logging, held outside the reach of the identities being logged.

## How security fails

- **Credential theft, then lateral movement** through every system that trusts the stolen identity.
- **CI/CD compromise.** The pipeline identity is usually the most privileged non-human principal in the estate.
- **KMS key deletion used as ransomware.** Delete or lock the key and every backup encrypted with it is unreadable.
- **A security agent's update crashing the fleet.** In July 2024 a CrowdStrike content update defined a template with 21 input fields while the integration code supplied 20; reading the 21st caused an out-of-bounds memory read [1] and a kernel crash on more than 8 million Windows systems, each of which had to be recovered by hand. Security agents are privileged, auto-updating kernel software, which makes them a fleet-wide reliability dependency.

## Trade-offs

**Inspection against privacy.** Decrypting traffic lets you see what leaves; it also creates a point where everything is in the clear, and breaks clients that pin certificates.

**A central vault against distributed secrets.** One vault is a single point of failure and a single target. Distributed secrets are sprawl. Workload identity sidesteps the choice for most machine-to-machine calls.

## Second-order effects

Security agents bring detection and also kernel privilege and auto-update, which makes them a shared dependency for the whole fleet. The answer the CrowdStrike incident points to is staged content rings with bake time, customer control over when content rolls out, runtime bounds checking, and tests that don't use wildcards where production won't.

## Questions to ask in a review

If this identity is stolen, what's the reachable set? Who can change the KMS key policy? When does each certificate expire, and who gets paged? What signs this artefact, and what checks the signature before it runs? Which of our agents can update themselves, and on whose schedule?

## Verified claims

Each numbered statement above, tied to the page that says it, the date it was last checked and the conditions it holds under.

1. CrowdStrike Channel File 291 defined 21 input fields while the integration code supplied 20, and reading the 21st caused an out-of-bounds read. Source: https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf. Checked 13 October 2026, tier T1. Holds when: Falcon sensor for Windows, version 7.11 and above, on 19 July 2024.

Should you have any questions regarding this page, please contact us at solutions@alesanalytics.com.

## Sources

1. [Channel File 291 Incident: Root Cause Analysis](https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf). CrowdStrike, 2024. The external technical root cause analysis of 6 August 2024: a template type defined 21 input fields, the integration code supplied 20, and reading the 21st was an out-of-bounds memory read.
2. [OWASP Top 10 for Agentic Applications for 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/). OWASP GenAI Security Project, 2025. Released 9 December 2025. ASI01 Agent Goal Hijack to ASI10 Rogue Agents.

## Where to go next

- Previous: [Compute and Kubernetes Architecture](https://www.alesanalytics.com/architecture/compute-and-kubernetes.md)
- Next: [Observability, Operations and Governance](https://www.alesanalytics.com/architecture/observability-and-operations.md)
- Overview and every page: [Enterprise Architecture Atlas](https://www.alesanalytics.com/architecture.md)
- The whole site in one file: https://www.alesanalytics.com/llms-full.txt