OWASP Non-Human Identities Top 10 • Hacker News Board

Re: OWASP Non-Human Identities Top 10

#21

Post by Ekaros » Tue, Feb 04, 2025, 9:34 AM UTC

octonaut wrote: post #20

TIL that OWASP has a bunch of Top 10 projects other than application security. Some others I found: - Top 10 for LLMs - https://owasp.org/www-project-top-10-for-large-language-mode... - Top 10 for OT - https://ot.owasp.org/ - Top 10 for Smart Contracts - https://owasp.org/www-project-smart-contract-top-10/ - Top 10 for Open Source Software - https://owasp.org/www-project-open-source-software-top-10/

I personally like the API one: https://owasp.org/API-Security/editions/2023/en/0x11-t10/

So many basic screwups.

Re: OWASP Non-Human Identities Top 10

#22

Post by batmansmk » Tue, Feb 04, 2025, 10:46 AM UTC

Identities are very hard to manage and secure overall. Audits are super long, tedious.

Adding more dimensions into reviews that aren't properly done right now will be extremely tricky.

Re: OWASP Non-Human Identities Top 10

#23

Post by 2d8a875f-39a2-4 » Tue, Feb 04, 2025, 11:24 AM UTC

I especially enjoyed NHI10:2025 Human Use of NHI.

Time to stop all that pesky human use. Switch off the servers too, just to be sure.

Re: OWASP Non-Human Identities Top 10

#24

Post by authnopuz » Tue, Feb 04, 2025, 12:03 PM UTC

Another good source of NHI definitions, concepts, and threats https://nhimg.org/the-ultimate-guide-to-non-human-identities

Re: OWASP Non-Human Identities Top 10

#25

Post by antithesis-nl » Tue, Feb 04, 2025, 12:28 PM UTC

I would love to hear about any useful work around leak/abuse-resistance improvements of service accounts and API keys (i.e. the 'NHI' referenced here -- awkward terminology!). Passkeys are a great solution when some kind of end-user interactivity is feasible, and AWS Secrets Manager is supposedly very good if you're entirely on that platform, but for self-hosting, the options seem limited (and things like Hashicorp Vault still don't fully solve the problem)?

I recently refactored a moderately complicated system to remove the need for periodic distribution of updated network access credentials, and the best I could come up with were X509 client certificates, which (even if in this case it was a big improvement over the existing state of affairs) feel archaic...

Re: OWASP Non-Human Identities Top 10

#26

Post by Temporary_31337 » Tue, Feb 04, 2025, 12:42 PM UTC

mirages wrote: post #17

This focuses mostly more on internal security (i.e after the attacker already has a foothold inside) versus the classic OWASP that are for external front fracing applications

It has long been consensus that perimeter security is an outdated concept. With servers in public clouds workers remote etc just assume that a breach could potentially happen and mitigate the potential damage - stealing credentials from a marketing guy should not result in root access to prod db.

Re: OWASP Non-Human Identities Top 10

#27

Post by lexicality » Tue, Feb 04, 2025, 12:47 PM UTC

LoganDark wrote: post #6

Hah, turns out they're talking about stuff like access tokens, not otherkin!

Glad I wasn't the only one whose mind immediately jumped to "On the internet, nobody knows you're a dog"

Re: OWASP Non-Human Identities Top 10

#28

Post by belter » Tue, Feb 04, 2025, 1:06 PM UTC

It’s already wise to establish a shared authentication word or phrase with family and colleagues, because AI can now convincingly mimic a person’s face, voice, gestures, even their gait during video calls or phone conversations. A bot won’t know the secret passcode when you ask for it.

Within the next 20–25 years, you may need that same safeguard in face-to-face meetings, since Replicants will be lifelike enough to fool anyone.

Voight-Kampff Test: https://youtu.be/IbBfONITYNg

Re: OWASP Non-Human Identities Top 10

#29

Post by marcosdumay » Tue, Feb 04, 2025, 1:19 PM UTC

CodeCompost wrote: post #18

Sorry but can anybody explain what Non-Human Identities are?

It's any user account you create that won't be used by a person.

Re: OWASP Non-Human Identities Top 10

#30

Post by jcmfernandes » Tue, Feb 04, 2025, 1:25 PM UTC

batmansmk wrote: post #22

Identities are very hard to manage and secure overall. Audits are super long, tedious. Adding more dimensions into reviews that aren't properly done right now will be extremely tricky.

Shameless plug: I work to make this easier at https://www.slashid.dev/products/identity-protection/

And yes, you're absolutely right. Attempting to manage NHIs across multiple cloud/service providers without having proper automation in place is a total nightmare.