Fashionable enterprise networks are extremely advanced environments that depend on a whole lot of apps and infrastructure providers. These programs have to work together securely and effectively with out fixed human oversight, which is the place non-human identities (NHIs) are available. NHIs — together with software secrets and techniques, API keys, service accounts, and OAuth tokens — have exploded lately, due to an ever-expanding array of apps and providers that should work collectively and establish each other on the fly. In some enterprises, NHIs now outnumber human identities by as a lot as 50-to-1.
Nevertheless, NHIs introduce distinctive dangers and administration challenges which have safety leaders on excessive alert. Forty-six p.c of organizations have skilled compromises of NHI accounts or credentials over the previous yr, and one other 26% suspect they’ve, in line with a current report from Enterprise Technique Group.
It is no marvel NHIs — and the difficulties they current with oversight, danger discount, and governance — have been a recurring subject at Okta’s CISO Discussion board. Right here, we’ll discover their rise, dangers, and the way CISOs and safety leaders are managing them right this moment.
The spectacular rise of NHIs
The rise in NHIs will be traced to the growing use of cloud providers, AI and automation, and digital workflows. It is a pattern that is prone to proceed, as increasingly duties are automated and people are much less of part of the equation.
NHIs permit apps to authenticate to at least one one other, each inside a particular area and with third-party functions like cloud providers. These secrets and techniques, keys, and tokens are simply as delicate because the credentials utilized by people, and in some instances, much more so, as they’ll present adversaries with highly effective entry to particular functions and providers in the event that they’re leaked.
CISOs are taking discover. In truth, over 80% of organizations count on to enhance spending on non-human id safety.
In accordance with Mark Sutton, CISO at Bain Capital, “Non-human identities have change into a spotlight for groups primarily based on the maturity of their id and entry administration applications. It is shortly turning into the following hottest hearth as a result of individuals have considerably solved person identities. The pure development is then to begin taking a look at service accounts and machine-to-machine non-human identities, together with APIs.”
Merely put, as soon as organizations set up sturdy protocols for securing human identities, the logical subsequent step is tackling NHIs. “That, and non-human identities are part of the risk panorama, and it is the place attackers are going subsequent.”
Secret leakage and different dangers of NHIs
Like another set of credentials, NHIs are delicate and must be protected. However whereas people can make use of strong safety measures reminiscent of MFA or biometrics to guard delicate credentials, NHIs usually depend on much less safe measures for authentication. That may make them simple targets for attackers.
Leakage of NHI secrets and techniques may also be a critical concern. This could occur in quite a lot of methods, whether or not it is by hard-coding them into an software’s supply code or by accident copying and pasting them right into a public doc. Secret leakage is a big drawback, and secrets and techniques usually present up in public GitHub repositories. In truth, safety agency GitGuardian discovered greater than 27 million new secrets and techniques in public repositories final yr. This poses a good bigger drawback when you think about that NHI secrets and techniques are usually not rotated fairly often in most environments, so the helpful lifetime of a leaked secret might be fairly lengthy.
And, as a result of they usually require broad and protracted permissions to carry out duties, NHIs can accumulate extreme permissions, additional growing the assault floor. All of this makes NHIs a main goal for attackers and a significant problem for CISOs and their safety groups.
Three challenges CISOs face in securing NHIs
Whereas NHIs at the moment are on CISOs’ radar, securing them is one other story. Listed below are three challenges we’re listening to from CISOs, and the way they’re managing them:
- Gaining visibility. The largest hurdle in attempting to safe and handle NHIs is definitely discovering them. Visibility into the place NHIs lie in an surroundings will be restricted, and discovering all and even most of them is a troublesome activity. Many organizations have hundreds of NHIs that they did not even know existed. The previous adage “you may’t safe what you do not know about” holds true right here. Which means discovering and inventorying NHIs is essential. Implementing an id safety posture administration resolution may also help admins and safety professionals establish NHIs throughout their group.
- Threat prioritization and discount. The subsequent problem is prioritizing the dangers related to the NHIs within the surroundings. Not all NHIs are created equal. Discovering essentially the most highly effective NHIs and figuring out over-privileged NHIs is a key step in securing these identities. Many service accounts and different NHIs have much more privileges than they really want, which may create dangers for the group. Figuring out high-value NHIs and adjusting privileges and permissions may also help cut back that danger. “It is about understanding the blast radius related to every non-human id and asking ‘what is the danger?’ Not all NHIs carry the identical risk,” Sutton careworn.
- Establishing governance. With so many NHIs being created right this moment, governance has change into an actual thorn within the aspect for CISOs. However after they’re not correctly ruled, dangerous issues can occur — take, as an illustration, the sequence of Web Archive breaches tied to unrotated tokens in October 2024. Typically, NHIs are created by builders to serve short-term wants, however they’re hardly ever tracked or decommissioned correctly. Understanding who’s creating NHIs, how they’re creating them, and for what objective is an efficient first step. Then, safety groups should set up a transparent course of for managing them so non-human identities cannot be created arbitrarily. “We now have to consider what our authentication and password insurance policies are,” says Sutton. “As an illustration, there are seemingly many service accounts with weak, static passwords that have not been rotated for years. How will we be certain we’re managing these?”
Ultimate ideas
Non-human identities are important to companies right this moment, serving to them automate processes, allow integrations, and guarantee clean operations. The problem: They’re troublesome to safe and are an attractive goal for risk actors as a result of they’re usually non-federated, lack MFA, use static credentials, and have extreme privileges.
On the finish of the day, non-human identities and human identities might have totally different traits and wishes, however each require an end-to-end strategy that protects them earlier than, throughout, and after authentication. NHIs will not be individuals, however they’re more and more highly effective actors in your surroundings. That makes securing them not elective, however pressing.
Be part of our webcast on August 18th to learn the way organizations are lowering danger and complexity by managing all identities — human or not — underneath one unified system.
