Skip to content

Commit

Permalink
deploy: a662dc3
Browse files Browse the repository at this point in the history
  • Loading branch information
@TalAstrix
TalAstrix committed Dec 10, 2024
1 parent 9768b31 commit 02f0430
Show file tree
Hide file tree
Showing 3 changed files with 333 additions and 14 deletions.
235 changes: 232 additions & 3 deletions 2025/introduction/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,11 @@
<label class="md-overlay" for="__drawer"></label>
<div data-md-component="skip">


<a href="#introduction" class="md-skip">
Skip to content
</a>

</div>
<div data-md-component="announce">

Expand Down Expand Up @@ -266,6 +271,19 @@
<input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">





<label class="md-nav__link md-nav__link--active" for="__toc">


<span class="md-ellipsis">
Introduction
</span>


<span class="md-nav__icon md-icon"></span>
</label>

<a href="./" class="md-nav__link md-nav__link--active">

Expand All @@ -277,6 +295,94 @@

</a>



<nav class="md-nav md-nav--secondary" aria-label="Table of contents">






<label class="md-nav__title" for="__toc">
<span class="md-nav__icon md-icon"></span>
Table of contents
</label>
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>

<li class="md-nav__item">
<a href="#what-are-non-human-identities-nhis" class="md-nav__link">
<span class="md-ellipsis">
What Are Non-Human Identities (NHIs)?
</span>
</a>

</li>

<li class="md-nav__item">
<a href="#the-importance-of-securing-nhis" class="md-nav__link">
<span class="md-ellipsis">
The Importance of Securing NHIs
</span>
</a>

</li>

<li class="md-nav__item">
<a href="#examples-of-risks-and-breaches" class="md-nav__link">
<span class="md-ellipsis">
Examples of Risks and Breaches
</span>
</a>

</li>

<li class="md-nav__item">
<a href="#about-the-owasp-nhi-top-10-project" class="md-nav__link">
<span class="md-ellipsis">
About the OWASP NHI Top 10 Project
</span>
</a>

<nav class="md-nav" aria-label="About the OWASP NHI Top 10 Project">
<ul class="md-nav__list">

<li class="md-nav__item">
<a href="#why-this-project-matters" class="md-nav__link">
<span class="md-ellipsis">
Why This Project Matters
</span>
</a>

</li>

<li class="md-nav__item">
<a href="#how-we-built-the-list" class="md-nav__link">
<span class="md-ellipsis">
How We Built the List
</span>
</a>

</li>

<li class="md-nav__item">
<a href="#what-developers-should-do" class="md-nav__link">
<span class="md-ellipsis">
What Developers Should Do
</span>
</a>

</li>

</ul>
</nav>

</li>

</ul>

</nav>

</li>


Expand Down Expand Up @@ -598,6 +704,85 @@






<label class="md-nav__title" for="__toc">
<span class="md-nav__icon md-icon"></span>
Table of contents
</label>
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>

<li class="md-nav__item">
<a href="#what-are-non-human-identities-nhis" class="md-nav__link">
<span class="md-ellipsis">
What Are Non-Human Identities (NHIs)?
</span>
</a>

</li>

<li class="md-nav__item">
<a href="#the-importance-of-securing-nhis" class="md-nav__link">
<span class="md-ellipsis">
The Importance of Securing NHIs
</span>
</a>

</li>

<li class="md-nav__item">
<a href="#examples-of-risks-and-breaches" class="md-nav__link">
<span class="md-ellipsis">
Examples of Risks and Breaches
</span>
</a>

</li>

<li class="md-nav__item">
<a href="#about-the-owasp-nhi-top-10-project" class="md-nav__link">
<span class="md-ellipsis">
About the OWASP NHI Top 10 Project
</span>
</a>

<nav class="md-nav" aria-label="About the OWASP NHI Top 10 Project">
<ul class="md-nav__list">

<li class="md-nav__item">
<a href="#why-this-project-matters" class="md-nav__link">
<span class="md-ellipsis">
Why This Project Matters
</span>
</a>

</li>

<li class="md-nav__item">
<a href="#how-we-built-the-list" class="md-nav__link">
<span class="md-ellipsis">
How We Built the List
</span>
</a>

</li>

<li class="md-nav__item">
<a href="#what-developers-should-do" class="md-nav__link">
<span class="md-ellipsis">
What Developers Should Do
</span>
</a>

</li>

</ul>
</nav>

</li>

</ul>

</nav>
</div>
Expand All @@ -615,9 +800,53 @@



<h1>Introduction</h1>

<p>TBA</p>
<h1 id="introduction">Introduction<a class="headerlink" href="#introduction" title="Permanent link">&para;</a></h1>
<h2 id="what-are-non-human-identities-nhis">What Are Non-Human Identities (NHIs)?<a class="headerlink" href="#what-are-non-human-identities-nhis" title="Permanent link">&para;</a></h2>
<p>Non-human identities (NHIs) are used to provide authorization to software entities such as applications, APIs, bots, and automated systems to access secured resources. Unlike human identities, NHIs are not controlled or directly owned by a human. Their identity object and authentication often work differently to human, and common human user security measures do not apply to them.</p>
<p>Examples of NHIs include:</p>
<ul>
<li>API keys used by microservices to access database applications.</li>
<li>Service accounts in backend systems connecting multiple subsystems.</li>
<li>Roles assocaited with automated services to access cloud resources.</li>
<li>Tokens used by bots to access protected application resources.</li>
</ul>
<p>As modern software becomes increasingly automated and interconnected, NHIs have become essential to application development.</p>
<hr />
<h2 id="the-importance-of-securing-nhis">The Importance of Securing NHIs<a class="headerlink" href="#the-importance-of-securing-nhis" title="Permanent link">&para;</a></h2>
<p>Mismanagement of NHIs introduces significant security risks. Key issues include:</p>
<ul>
<li><strong>Excessive Permissions</strong>: NHIs are commonly granted very broad access to resources which leads to a widespread damage if compromised.</li>
<li><strong>Credential Mismanagement</strong>: NHI credentials can easily be wrongly managed: leaving hardcoded keys in code, poor or no rotation policies, and usage of deprecated authentication method make NHI vulnerable to compromise. </li>
<li><strong>Lack of Monitoring</strong>: NHIs are notoriously under-monitored, allowing malicious activity to go unnoticed.</li>
</ul>
<p>The key issues above make it so a compromised NHIs can lead to unauthorized access, data breaches, or attacks on infrastructure. With NHIs playing critical roles in development pipelines, cloud environments, and SaaS ecosystems, securing them is essential.</p>
<hr />
<h2 id="examples-of-risks-and-breaches">Examples of Risks and Breaches<a class="headerlink" href="#examples-of-risks-and-breaches" title="Permanent link">&para;</a></h2>
<p>In recent worlds, with the increase of prevalence in using NHIs, real-world incidents involving a compromised NHI have grown exponentially. Some of the highest profile incidents are presented below and demonstrate the risks of insecure NHIs:</p>
<ul>
<li><a href="https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/"><strong>Microsoft's Midnight Blizzard Breach (January 2024)</strong></a>: A nation-state actor, Midnight Blizzard, initiated an attack against Microsoft's tenant. After gaining access to a non-production Microsoft 365 test tenant, they exploited a legacy OAuth application — an unmanaged non-human identity — with full privileges to access Microsoft's production environment. This led to unauthorized access to corporate email accounts, resulting in the exfiltration of sensitive communications and documents. </li>
<li><a href="https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause"><strong>Okta's Support System Breach (November 2023)</strong></a>: Okta has experienced a security breach involving a compromised service account. An employee had saved the credentials for this service account to their personal Google account after signing in on an Okta-managed device. The compromise of the employee's personal Google account allowed attackers to obtain these credentials, granting unauthorized access to Okta's customer support system. The attackers accessed files related to 134 customers, including HTTP Archive (HAR) files containing sensitive data like session tokens.</li>
<li><a href="https://www.bleepingcomputer.com/news/security/internet-archive-breached-again-through-stolen-access-tokens/"><strong>Internet Archive's Zendesk Support Platform Breach (October 2024)</strong></a>: Attackers exploited unrotated access tokens tied to the Internet Archive's Zendesk support platform, leading to unauthorized access and potential data exposure. This incident highlights the importance of regularly rotating and securing non-human identity credentials to prevent unauthorized access. </li>
</ul>
<hr />
<h2 id="about-the-owasp-nhi-top-10-project">About the OWASP NHI Top 10 Project<a class="headerlink" href="#about-the-owasp-nhi-top-10-project" title="Permanent link">&para;</a></h2>
<p>The <strong>OWASP Non-Human Identity (NHI) Top 10</strong> identifies and ranks the most critical risks associated with NHIs, providing a practical guide for developers and organizations. </p>
<h3 id="why-this-project-matters">Why This Project Matters<a class="headerlink" href="#why-this-project-matters" title="Permanent link">&para;</a></h3>
<p>As NHIs become more prevalent, securing them has become as important as protecting human users. This project aims to:</p>
<ul>
<li>Raise awareness of NHI-related security challenges.</li>
<li>Offer actionable insights for securing NHIs from their most dangerous risks.</li>
<li>Help developers and organizations prioritize risks and implement best practices.</li>
</ul>
<h3 id="how-we-built-the-list">How We Built the List<a class="headerlink" href="#how-we-built-the-list" title="Permanent link">&para;</a></h3>
<p>We identified key risks through real-world incidents, surveys, CVE databases, and industry input. Using the collected data and based on the <a href="https://owasp.org/www-community/OWASP_Risk_Rating_Methodology">OWASP Risk Rating Methodology</a>, we ranked the top 10 risks to provide a clear prioritized list.</p>
<h3 id="what-developers-should-do">What Developers Should Do<a class="headerlink" href="#what-developers-should-do" title="Permanent link">&para;</a></h3>
<p>Developers can use this project to:</p>
<ol>
<li>Understand the risks associated with NHIs in their applications.</li>
<li>Apply the recommended practices to secure NHIs and mitigate threats.</li>
<li>Monitor and improve their NHI security continuously.</li>
</ol>



Expand Down
Loading

0 comments on commit 02f0430

Please sign in to comment.