How attackers exploit non-human identities: Workshop recap
In the workshop we demonstrated a full attack path exploiting non-human identities, starting with initial access to AWS through an exposed secret in a public GitHub repo. We then continued to privilege escalation through a service account, gained access to source code, and managed to steal customer details and perform ... Read More
The Service Accounts Conundrum: What They Are and How to Secure Them
The definition of a 'service account' is vague, their use is unstructured and that makes securing them incredibly challenging ... Read More
OAuth attack against Microsoft by Midnight Blizzard
Midnight Blizzard, the Russian state-sponsored actors, were abusing OAuth applications as part of their attack against Microsoft’s corporate environment. Learn about the attack flow and get the recommended remediation steps. The post OAuth attack against Microsoft by Midnight Blizzard appeared first on Astrix Security ... Read More
Part 1: Non-human identity security – The complete technical guide
“Identity is the new perimeter.” This catch phrase is present in almost every website of identity security vendors, and for a good reason. Human access, more commonly referred to as user access, is an established security program in most organizations – big or small. The realization that user identities and ... Read More
