Details
Improper access control can lead to non-human identities gaining unauthorized access to sensitive resources or performing actions beyond their intended scope. This risk often arises from misconfigured permissions, overly broad access policies, or a lack of granular control.
Stay Informed
Video Explanation
Enhance Your Security Posture
Learn how to protect your non-human identities and strengthen your overall cybersecurity strategy.
Get StartedExample Scenario
HealthTech Solutions develops a revolutionary AI-driven diagnostic tool for hospitals. To train their model, they set up a data pipeline that pulls anonymized patient records from various health institutions. Due to a misconfiguration in their access controls, the AI service account gains write access to the source databases instead of read-only access. During a routine update, a bug in the AI system causes it to write corrupted data back to the source databases. This leads to numerous misdiagnoses and incorrect treatments before the error is caught. The incident results in potential harm to patients, multiple malpractice lawsuits against the hospitals, and a federal investigation into HealthTech Solutions' data handling practices.
Mitigation Strategies
- Implement the principle of least privilege for all non-human identities
- Use role-based access control (RBAC) and attribute-based access control (ABAC)
- Regularly review and audit access permissions
Best Practices
- Implement segregation of duties for critical systems
- Use just-in-time (JIT) access for elevated permissions
- Conduct regular access reviews and revoke unnecessary permissions
References
Related Risks
Inadequate deactivation or removal of non-human identities when no longer needed....
Learn More about Improper OffboardingLearn more about Improper OffboardingUnintended exposure of sensitive non-human identity credentials to unauthorized parties....
Learn More about Secret LeakageLearn more about Secret LeakageNon-human identities are granted more permissions than necessary for their intended functions....
Learn More about Excessive PermissionsLearn more about Excessive PermissionsFailure to regularly update or rotate credentials for non-human identities....
Learn More about Inadequate RotationLearn more about Inadequate Rotation