Trendy enterprise networks are extremely complicated environments that depend on tons of of apps and infrastructure providers. These methods must work together securely and effectively with out fixed human oversight, which is the place non-human identities (NHIs) are available. NHIs — together with software secrets and techniques, API keys, service accounts, and OAuth tokens — have exploded lately, because of an ever-expanding array of apps and providers that should work collectively and determine each other on the fly. In some enterprises, NHIs now outnumber human identities by as a lot as 50-to-1.
Nonetheless, NHIs introduce distinctive dangers and administration challenges which have safety leaders on excessive alert. Forty-six p.c of organizations have skilled compromises of NHI accounts or credentials over the previous yr, and one other 26% suspect they’ve, in accordance with a current report from Enterprise Technique Group.
It is no surprise NHIs — and the difficulties they current with oversight, threat discount, and governance — have been a recurring matter at Okta’s CISO Discussion board. Right here, we’ll discover their rise, dangers, and the way CISOs and safety leaders are managing them immediately.
The spectacular rise of NHIs
The rise in NHIs will be traced to the growing use of cloud providers, AI and automation, and digital workflows. It is a development that is more likely to proceed, as increasingly more duties are automated and people are much less of part of the equation.
NHIs enable apps to authenticate to at least one one other, each inside a particular area and with third-party purposes like cloud providers. These secrets and techniques, keys, and tokens are simply as delicate because the credentials utilized by people, and in some circumstances, much more so, as they’ll present adversaries with highly effective entry to particular purposes and providers in the event that they’re leaked.
CISOs are taking discover. In truth, over 80% of organizations anticipate to enhance spending on non-human identification safety.
In response to Mark Sutton, CISO at Bain Capital, “Non-human identities have grow to be a spotlight for groups primarily based on the maturity of their identification and entry administration packages. It is rapidly turning into the following hottest fireplace as a result of individuals have considerably solved consumer identities. The pure development is then to start out service accounts and machine-to-machine non-human identities, together with APIs.”
Merely put, as soon as organizations set up sturdy protocols for securing human identities, the logical subsequent step is tackling NHIs. “That, and non-human identities are part of the risk panorama, and it is the place attackers are going subsequent.”
Secret leakage and different dangers of NHIs
Like every other set of credentials, NHIs are delicate and must be protected. However whereas people can make use of sturdy safety measures comparable to MFA or biometrics to guard delicate credentials, NHIs usually depend on much less safe measures for authentication. That may make them simple targets for attackers.
Leakage of NHI secrets and techniques will also be a critical concern. This could occur in quite a few methods, whether or not it is via hard-coding them into an software’s supply code or unintentionally copying and pasting them right into a public doc. Secret leakage is a major downside, and secrets and techniques usually present up in public GitHub repositories. In truth, safety agency GitGuardian discovered greater than 27 million new secrets and techniques in public repositories final yr. This poses a fair bigger downside when you think about that NHI secrets and techniques aren’t rotated fairly often in most environments, so the helpful lifetime of a leaked secret may very well be fairly lengthy.
And, as a result of they usually require broad and chronic permissions to carry out duties, NHIs can accumulate extreme permissions, additional growing the assault floor. All of this makes NHIs a primary goal for attackers and a serious problem for CISOs and their safety groups.
Three challenges CISOs face in securing NHIs
Whereas NHIs are actually on CISOs’ radar, securing them is one other story. Listed here are three challenges we’re listening to from CISOs, and the way they’re managing them:
- Gaining visibility. The largest hurdle in making an attempt to safe and handle NHIs is definitely discovering them. Visibility into the place NHIs lie in an atmosphere will be restricted, and discovering all and even most of them is a tough activity. Many organizations have hundreds of NHIs that they did not even know existed. The outdated adage “you may’t safe what you do not know about” holds true right here. Meaning discovering and inventorying NHIs is important. Implementing an identification safety posture administration answer will help admins and safety professionals determine NHIs throughout their group.
- Threat prioritization and discount. The subsequent problem is prioritizing the dangers related to the NHIs within the atmosphere. Not all NHIs are created equal. Discovering probably the most highly effective NHIs and figuring out over-privileged NHIs is a key step in securing these identities. Many service accounts and different NHIs have way more privileges than they really want, which might create dangers for the group. Figuring out high-value NHIs and adjusting privileges and permissions will help cut back that threat. “It is about understanding the blast radius related to every non-human identification and asking ‘what is the threat?’ Not all NHIs carry the identical risk,” Sutton pressured.
- Establishing governance. With so many NHIs being created immediately, governance has grow to be an actual thorn within the aspect for CISOs. However once they’re not correctly ruled, dangerous issues can occur — take, for example, the collection of Web Archive breaches tied to unrotated tokens in October 2024. Typically, NHIs are created by builders to serve short-term wants, however they’re not often tracked or decommissioned correctly. Understanding who’s creating NHIs, how they’re creating them, and for what objective is an effective first step. Then, safety groups should set up a transparent course of for managing them so non-human identities cannot be created arbitrarily. “We’ve got to consider what our authentication and password insurance policies are,” says Sutton. “For example, there are doubtless many service accounts with weak, static passwords that have not been rotated for years. How can we be certain we’re managing these?”
Last ideas
Non-human identities are important to companies immediately, serving to them automate processes, allow integrations, and guarantee easy operations. The problem: They’re tough to safe and are an attractive goal for risk actors as a result of they’re usually non-federated, lack MFA, use static credentials, and have extreme privileges.
On the finish of the day, non-human identities and human identities might have totally different traits and desires, however each require an end-to-end strategy that protects them earlier than, throughout, and after authentication. NHIs might not be individuals, however they’re more and more highly effective actors in your atmosphere. That makes securing them not non-obligatory, however pressing.
Be a part of our webcast on August 18th to learn the way organizations are lowering threat and complexity by managing all identities — human or not — beneath one unified system.
