Non-Human Identity Management

Originally published by Oasis.

Non-human identities, or NHIs, serve as digital gatekeepers, enabling secure machine-to-machine and human-to-machine access and authentication within modern enterprise systems. The push for innovation has led to the adoption of microservices, third-party solutions, and cloud-based platforms, creating a complex web of interconnected systems.

In this intricate network, NHIs are key players in facilitating secure communication and authentication. Their numbers surpass human identities by a factor of 10 to 50, highlighting their essential role in today's digital ecosystems.

‍

What is Non-Human Identity Management?

Non-Human Identity Management (NHIM) is the process of governing and automating the entire lifecycle of non-human identities. This process includes:

• Discovery and classification
• Provisioning
• Ownership Assignment
• Posture Monitoring and Detection
• Vaulting and Secure Storage
• Rotation of Credentials
• Compliance
• Decommissioning

‍

Why do we need non-human identity management?

Effective NHIM is essential for several reasons:

• Identity-based breaches have grown significantly, according to the IBM Cost of a Data Breach Report 2023, the global average cost of a data breach in 2023 was USD 4.45 million, marking a 15% increase over three years. Moreover, credentials remain the primary target for attackers. The 2024 Data Breach Investigations Report by Verizon states that stolen credentials account for 77% of basic web application attacks.
  The threat is real, even for the most security-aware organizations. Below is an illustrative list of compromised organizations in the last 12 months:‍
  • Cloudflare
  • Microsoft
  • Github
  • Mercedes-Benz
  • Change Healthcare‍
• Traditional Identity Governance and Administration (IGA) tools are designed with human identities in mind, relying on authoritative sources such as human resources (HR) or Active Directory. However, these tools fall short when applied to non-human identities, which are decentralized and distributed across various environments (in the cloud(s), on-premises system,...).
• Modern enterprise systems are characterized by a network of interconnected devices, applications, and automated processes. The scale and growth of NHIs, combined with the lack of a centralized repository and clear ownership, makes operationalizing security policies and best practices for NHIs extremely hard without purpose-built automation.

‍

Unmanaged NHIs can expose organizations to security violations

Referring to the MITRE ATT&CK Matrix for Enterprise, NHIs are involved in various adversary tactics and techniques, including:

• Initial access: The adversary tries to enter your network.some text
  • Supply Chain Compromise (T1195)
  • Trusted Relationship (T1199)
  • Valid Accounts (T1078)
• Persistence: The adversary aims to maintain access. some text
  • Account Manipulation (T1098)
  • Create Account (T1136)
  • Valid Accounts (T1078)
• Credential Access: The adversary tries to steal credentials aiming to escalate privileges and move laterally within the network.some text
  • Credentials from Password Stores (T1555)
  • Unsecured Credentials (T1552)
  • Steal Application Access Token (T1528)

Attackers gain access via NHI using the following threat vectors:

• Stale privileged unrotated NHIs: Despite their privileged access, stale or orphaned accounts remain unchanged and susceptible to exploitation due to the lack of ownership and accountability and lack of credential rotation.
• Unrotated secrets exposed to off-boarded employees: Secrets left unrotated and exposed to a former employee pose a significant risk, especially when they can be accessed on the internet and have privileged access.
• Stale storage accounts: Stagnant storage accounts present a potential security loophole, outdated configurations might leave sensitive data vulnerable to unauthorized access or compromise.
• Active secrets with 50+ year expiration data: Secrets with excessively long expiration dates pose a security risk, they provide an extended window of opportunity for malicious actors to exploit vulnerabilities.
• Vaults with unused access policies: Vaults containing unused access policies represent an overlooked security gap, they may inadvertently grant unauthorized access to sensitive resources or data.

Being able to find and highlight these vulnerabilities is the first step to proactively managing and securing non-human identities to mitigate security risks and safeguard organizational assets.

How to choose the right NHIM platform

NHIM represents a significant shift in Identity and access management (IAM). While identity has become the new security perimeter, focusing only on human identities is no longer enough. Organizations need specialized solutions designed specifically for the unique requirements of non-human entities These solutions should address fundamental requirements, including:

• Holistic Contextual Visibility: Complete visibility into the non-human identity landscape is indispensable. An NHIM platform should offer holistic contextual visibility, providing insights into usage patterns, dependencies, and relationships within the ecosystem.
• Work across the hybrid cloud: the NHIM platform must go beyond the boundaries of traditional infrastructure and must operate seamlessly across hybrid cloud environments. From leading Infrastructure as a Service (IaaS) providers like AWS, Azure, and GCP to Platform as a Service (PaaS) and Software as a Service (SaaS) offerings, the platform should cover the full range of cloud technologies as well as on-premise services.
• Active Posture Management: Proactive posture management is indispensable in the face of evolving threats. An NHIM platform should enable organizations to assess the security posture of non-human identities in real-time and take proactive measures to mitigate risks.
• Lifecycle Management & Automation: From provisioning to rotation and decommissioning, lifecycle management of non-human identities must be automated. An NHIM platform should offer robust capabilities for automating key lifecycle management tasks, enhancing operational efficiency and security.
• Work across secret managers and PAMs: An NHI platform should integrate with popular secret management solutions such as HashiCorp Vault, Azure Key Vault, and CyberArk. Moreover, seamless interoperability with Privileged Access Management (PAM) solutions like CyberArk and Delinea so that secrets found by the NHI platform can be properly secured and vaulted in the PAM solution.
• Developer-ready: The NHIM platform should feature robust APIs for easy integration with applications and services, supporting automation and customization. It should also integrate seamlessly with the operational stack, including Infrastructure as Code (IaC) tools, IT Service Management (ITSM) systems, logging frameworks, and development tools.

By implementing a robust NHIM platform, equipped with the integration to the necessary ecosystem and capabilities, organizations can effectively manage non-human identities, strengthen their security posture, and fully leverage the benefits of automation and interconnected systems.