Back to Top 10
Illustration for Insufficient Identity Governance
NHI8:2025
Insufficient Identity Governance
Lack of proper governance and lifecycle management for non-human identities.

Details

Insufficient identity governance can lead to a proliferation of unmanaged or poorly managed non-human identities. This increases the attack surface and makes it difficult to maintain security and compliance.

Video Explanation

Enhance Your Security Posture

Enhance Your Security Posture

Learn how to protect your non-human identities and strengthen your overall cybersecurity strategy.

Get Started

Example Scenario

GlobEx, a rapidly expanding e-commerce platform, grows through multiple acquisitions. Each acquired company brings its own set of non-human identities, from database service accounts to API keys for various services. In the rush to integrate, GlobEx fails to implement proper identity governance. Two years later, during a routine security audit, they discover over 5,000 active non-human identities, with no clear ownership or purpose for many of them. Some of these identities belong to services long since decommissioned, while others have dangerously overlapping permissions. The tangled mess of identities makes it impossible to ensure proper security measures, leading to numerous vulnerabilities and compliance violations. GlobEx is forced to freeze all major operations for weeks to untangle and rectify the situation, resulting in significant financial losses and damaged customer trust.

Mitigation Strategies

  • Implement a comprehensive identity governance and administration (IGA) solution
  • Establish clear policies and procedures for non-human identity lifecycle management
  • Conduct regular identity reviews and cleanup processes

Best Practices

  • Maintain an up-to-date inventory of all non-human identities
  • Implement automated provisioning and de-provisioning processes
  • Use analytics and AI to identify anomalies and potential risks in identity data

References

Related Risks

Improper Offboarding

Inadequate deactivation or removal of non-human identities when no longer needed....

Learn More about Improper OffboardingLearn more about Improper Offboarding
Secret Leakage

Unintended exposure of sensitive non-human identity credentials to unauthorized parties....

Learn More about Secret LeakageLearn more about Secret Leakage
Excessive Permissions

Non-human identities are granted more permissions than necessary for their intended functions....

Learn More about Excessive PermissionsLearn more about Excessive Permissions
Inadequate Rotation

Failure to regularly update or rotate credentials for non-human identities....

Learn More about Inadequate RotationLearn more about Inadequate Rotation