Organizations still don’t know how to handle non-human identities

Organizations are grappling with their current NHI (non-human identities) security strategies, according to Cloud Security Alliance and Astrix Security.

The high volume of NHIs significantly amplifies the security challenges organizations face. Each NHI can potentially access sensitive data and critical systems, increasing the attack surface exponentially. Without adequate visibility and control over these NHIs, the risk of security incidents rises. Organizations’ lack of confidence suggests their current NHI security methods are lagging behind their human identity security methods.

The most common challenges include service account management and NHI discovery. Though the survey also revealed there is a growing recognition of the importance of investing in NHI security with 1 in 4 organizations already investing in these capabilities and an additional 60% planning to within the next twelve months.

“NHIs – like bots, API keys, service accounts, OAuth tokens, and secrets – are all lifelines of today’s organizations, enabling automation, efficiency, and innovation,” said John Yeoh, Global VP of Research at CSA.

“And while organizations recognize the importance of securing NHIs and often deploy a mix of tools like Identity Access Management systems, these tools are not specifically tailored to the unique challenges that NHIs present. The mismatch is evident in recent attacks on major brands like AWS, Okta, Cloudflare, and Microsoft, where despite having security measures in place, hackers still managed to infiltrate. This joint survey only underscores this vast issue, highlighting that NHIs can not be treated the same as human identities,” added Yeoh.

Current tooling is inadequate to secure NHIs

Nearly 1 in 5 organizations have experienced a security incident related to NHIs.

There is a significant gap in organizations’ security methods with only 1.5 out of 10 organizations highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities. This lack of confidence in securing NHIs versus human identities could be due to the sheer volume of NHIs in their environment, which often outnumber human identities by a factor of 20 to 1.

The reason organizations are struggling with the basics of NHI security may stem from a fragmented approach to managing NHI security. Many organizations are not using tools specifically designed for NHI security. Instead, they are relying on a mix of various security tools that are not tailored to the unique challenges NHIs present.

For instance: 58% use Identity and Access Management (IAM) systems; 54% use Privileged Access Management (PAM); 40% use API security measures; 38% employ zero trust/least privilege strategies; 36% use Secrets Management tools.

As a result, the three most common causes of NHI security incidents include lack of credential rotation (45%), inadequate monitoring and logging (37%), and over-privileged accounts or identities (37%).

Struggling with fundamental security practices related to NHIs

Major challenges that organizations encounter include auditing and monitoring (25%); access and privileges (25%); discovering NHIs (24%); and policy reinforcement (21%).

Another significant concern is the struggle to gain visibility into third-party vendors connected by OAuth apps, with 38% of organizations reporting no or low visibility into third-party vendors, and another 47% having only partial visibility.

“As organizations increasingly acknowledge the critical need for robust NHI security, the surge in investments reflects a proactive stance toward protecting our digital infrastructures,” said Alon Jackson, CEO at Astrix Security.

“The key now is ensuring these investments are channeled into the right tools, especially as vulnerabilities persist. NHIs present unique challenges distinct from human identities, making their security complex and demanding. Addressing NHI security requires ongoing refinement, adaptable strategies, and a unified effort to tackle the ever-evolving threats head-on,” concluded Jackson.

There is a promising shift as many organizations are planning to invest significantly in NHI security capabilities. This planned investment indicates a growing recognition of the importance of proactively addressing NHI security. By unifying their strategies, adopting NHI-specific tools, and automating critical processes, such as permission management and API key handling, organizations can enhance their security posture and better protect against evolving threats.

This concerted effort will be crucial in closing the gaps identified in the survey and ensuring robust security for NHis in the future.