Back to Top 10
Illustration for Inadequate Rotation
NHI4:2025
Inadequate Rotation
Failure to regularly update or rotate credentials for non-human identities.

Details

Inadequate rotation of non-human identity credentials increases the risk of unauthorized access. If credentials remain unchanged for extended periods, they become more vulnerable to compromise through various attack vectors.

Video Explanation

Enhance Your Security Posture

Enhance Your Security Posture

Learn how to protect your non-human identities and strengthen your overall cybersecurity strategy.

Get Started

Example Scenario

SecureBank prides itself on its robust security measures. However, they overlook the importance of regularly rotating their non-human identity credentials. The same API key for their core transaction processing system has been in use for over three years. A sophisticated hacking group, through a long-term reconnaissance mission, manages to intercept this key during a routine data transfer. Over the next few months, they slowly and methodically drain funds from high-value accounts, carefully staying below detection thresholds. By the time the breach is discovered, the hackers have siphoned off over $50 million. The incident not only results in massive financial loss but also severely damages SecureBank's reputation and leads to increased regulatory scrutiny.

Mitigation Strategies

  • Implement automated credential rotation processes
  • Use short-lived tokens or certificates where possible
  • Monitor and alert on credential age and usage patterns

Best Practices

  • Set up a regular schedule for credential rotation
  • Use secrets management systems that support automatic rotation
  • Implement proper key versioning and rollover procedures

References

Related Risks

Improper Offboarding

Inadequate deactivation or removal of non-human identities when no longer needed....

Learn More about Improper OffboardingLearn more about Improper Offboarding
Secret Leakage

Unintended exposure of sensitive non-human identity credentials to unauthorized parties....

Learn More about Secret LeakageLearn more about Secret Leakage
Excessive Permissions

Non-human identities are granted more permissions than necessary for their intended functions....

Learn More about Excessive PermissionsLearn more about Excessive Permissions
Insecure Communication

Non-human identities communicate over insecure channels or without proper encryption....

Learn More about Insecure CommunicationLearn more about Insecure Communication