The Identity Reality
Modern cloud environments are dominated by machines.
Securing the Silent Majority: Navigating the OWASP NHI Top 10
Bridging the visibility gap between unmanaged service accounts and enterprise-grade governance.
Improper Offboarding
Inadequate deactivation leaves "ghost" credentials active.
Secret Leakage
Accidental exposure of API keys and tokens in code or logs.
Vulnerable Third-Party NHI
Excessive permissions granted to SaaS integration roles.
Insecure Authentication
Reliance on static, long-lived keys instead of rotated tokens.
Overprivileged NHI
Violating Least Privilege, expanding the blast radius.
Insecure Cloud Deployment
Vulnerabilities injected via CI/CD pipelines.
Long-Lived Secrets
Credentials that never expire, providing indefinite access upon theft.
Environment Isolation
Lack of segregation allows lateral movement between Dev and Prod.
NHI Reuse
Sharing identity across services impedes audit and blast containment.
Human Use of NHI
Operators bypassing MFA by using machine service accounts.
The Trivy Kill Chain
Mapping the OWASP NHI Top 10 to the anatomy of the Trivy supply chain breach.
Stage 1: Weaponizing the aqua-bot
Attackers compromised the aqua-bot service account, leveraging its overprivileged standing access to push malicious payloads.
Stage 2: Credential Harvesting
The payload scraped workflow environments, gathering long-lived CI/CD tokens and cloud deployment secrets to expand its reach.
Stage 3: Unrestricted Tokens
Exploiting default, read/write API tokens, the malware spawned external repositories, violating environment isolation to exfiltrate data.
Stage 4: Developer Persistence
The malicious binary embedded itself into developer environments via systemd units, acting as an autonomous identity polling C2 servers.