[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fc06vnxJnGLNAwSvPN5I_A751DtsEcIBSHIS0q0hY6LQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":37,"created_at":38,"published_at":39,"article":40,"tags":44,"podcasts":57,"controls":58},"c6aaba06-7c44-4085-96aa-b7f913fdb2c3","ghost-credentials-dormant-non-human-identities-create-hidden-cloud-attack-paths","195c70e8-ec8b-47ec-add9-dba0eebd97c5","Ghost Credentials: Dormant Non-Human Identities Create Hidden Cloud Attack Paths","Organizations accumulate non-human identities (NHIs) — such as service accounts, API keys, and automation tokens — that are provisioned but never properly decommissioned, leaving 'ghost credentials' that remain valid and exploitable long after their intended use. Because these identities are rarely monitored or reviewed, attackers who discover them can leverage established trust relationships to move laterally or escalate privileges within cloud environments without triggering standard detection controls. The core failure is the absence of a systematic identity lifecycle management process that treats NHIs with the same rigor applied to human user accounts. This matters because cloud environments scale NHI proliferation rapidly, making manual tracking impractical and dramatically expanding the attack surface if no automated discovery tooling is in place.","**Immediate actions:**\n- Conduct an urgent audit of all non-human identities (service accounts, API keys, OAuth tokens) across every cloud environment to identify dormant or unmanaged credentials.\n- Deploy an open-source or commercial NHI discovery tool (e.g., NHI Hound) to surface ghost credentials that fall outside existing IAM visibility.\n- Revoke or rotate any NHI credential that cannot be attributed to an active, documented business purpose.\n\n**Long-term improvements:**\n- Implement a formal NHI lifecycle management policy that mandates provisioning approval, periodic re-certification, and automatic expiration for all non-human identities.\n- Enforce least-privilege principles for every NHI so that credentials carry only the minimum permissions required for their specific function.\n- Integrate NHI inventory into your CMDB or identity governance platform to ensure continuous visibility as environments scale.\n\n**Detection measures:**\n- Enable cloud-native audit logging (e.g., AWS CloudTrail, Azure Monitor, GCP Audit Logs) and alert on authentication events from NHIs that have not been active within a defined threshold (e.g., 90 days).\n- Establish behavioural baselines for NHI activity and trigger anomaly alerts when credentials are used from unexpected regions, services, or at unusual times.\n- Schedule quarterly automated scans to detect newly orphaned credentials introduced through infrastructure changes or developer activity.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 IA-4: Identifier Management","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF PR.AC-1: Identities and credentials are managed for authorized devices and users","NIST CSF DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events","ISO\u002FIEC 27001:2022 A.5.16: Identity Management","ISO\u002FIEC 27001:2022 A.8.2: Privileged Access Rights","GDPR Article 32: Security of Processing (access control obligations)",{"CIS Control 5: Account Management":25,"CIS Control 8: Audit Log Management":26,"NIST SP 800-53 AC-2: Account Management":27,"NIST SP 800-53 AC-3: Access Enforcement":28,"CIS Control 6: Access Control Management":29,"NIST SP 800-53 IA-4: Identifier Management":30,"ISO\u002FIEC 27001:2022 A.5.16: Identity Management":31,"ISO\u002FIEC 27001:2022 A.8.2: Privileged Access Rights":32,"NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting":33,"GDPR Article 32: Security of Processing (access control obligations)":34,"NIST CSF PR.AC-1: Identities and credentials are managed for authorized devices and users":35,"NIST CSF DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events":36},"Account management includes decommissioning service accounts and API keys when no longer needed, the gap behind ghost credentials.","Audit logs help detect dormant service accounts suddenly becoming active, a sign of ghost credential abuse.","Account management requires reviewing and removing unused accounts, including non-human identities.","Access enforcement should apply to service accounts and tokens as strictly as to human users.","Access control management limits what non-human identities can reach, reducing the damage from forgotten credentials.","Identifier management includes tracking and retiring identifiers for service accounts and automation.","Identity management covers the full lifecycle of non-human identities, including decommissioning.","Privileged access rights should be reviewed regularly, including for powerful service accounts.","Reviewing audit records for unused or anomalous non-human identity activity helps detect abuse.","Access control obligations extend to service accounts that can reach personal data.","Managing identities and credentials includes non-human identities that are often overlooked.","Monitoring activity helps spot misuse of dormant service accounts and API keys.","published","2026-07-29T00:21:06.064236+00:00","2026-07-29T00:21:05.946+00:00",{"id":7,"url":41,"slug":42,"title":43},"https:\u002F\u002Fwww.darkreading.com\u002Fcloud-security\u002Fnon-human-identity-sprawl-creates-a-new-cloud-attack-path","ghost-credentials-expose-cloud-systems-to-hidden-identity-risks-331be8","Ghost Credentials Expose Cloud Systems to Hidden Identity Risks",[45,51],{"id":46,"name":47,"slug":48,"description":49,"color":50},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":52,"name":53,"slug":54,"description":55,"color":56},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[59,63,67],{"slug":60,"name":61,"problem":62},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":64,"name":65,"problem":66},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":68,"name":69,"problem":70},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]