Oasis Security’s Post

Transcript

The key to success here would be to rotate safely, rotate often, and more importantly, maybe it is to rotate everything, every single non-human service account you have. Hello everyone, my name is Marta, I'm a PMM with Oasis, and it's my pleasure to be here with Barak, and Oasis Chief Architect today to talk about service accounts. Hello, Barak, how are you? I'm doing great, Marta, how are you? Good, thank you. So I want to learn more about service accounts and I want to dive in really quickly. First of all, give us like a small definition, very easy, what is a service account? So a service account is one of the common ways that we provide a digital identity for applications and services. This digital identity is then used to authenticate the application and to authorize it to access resources such as services and databases. Service accounts are commonly used both on premise, but they are also used in the cloud and SaaS applications, obviously. I see, and I've read a lot on LinkedIn these days, what are the risks associated with these type of accounts? Authentication to service accounts is usually facilitated through a secret. This could be a password or a key or even a certificate. So this creates an inherent risk of the secret being compromised. There are many causes for secrets to be leaked, some misconfigurations, human error, malicious threats, just to name a few, but security experts maintain that it's not a question if a secret will leak but rather just a question on when. If it's a matter of time for service accounts to get breach, why do we need service accounts in the first place? And maybe what I'm thinking is shouldn't we avoid them? So the answer is yes, but there's a trade-off we need to consider. One of the capabilities of service accounts is their mobility. Service accounts can be consumed by multiple workloads and can even be used from human endpoints. So developers and application owners will often need to access parts of our applications or resources to help solve issues or run maintenance. So for them having a service account is very convenient. The challenge here is that this greatly increases the risk of exposure. So the more commonly the service account is being used, the more ability for attackers to essentially get that secret. it becomes a wider attack surface. And this is a common trade-off between operational efficiency and cybersecurity. I understand now. And I've heard from a lot of our customers that they use PAM solutions to manage their service accounts. What would you say to them? So PAM is a great solution to manage human access to service accounts, creating what is commonly called a break-less account or administrative service accounts. However, out of the box, PAM solutions fail to serve The wider range of usages around non-human identities So the key to success here would be to rotate safely, rotate often, or more importantly, maybe it is to rotate everything, every single non-human service account you have. So On-Premis in the cloud, in SaaS, everywhere. PAM solutions leave security personnel and IAM teams to manually connect applications to their vaults, verify usage in sign-in logs, notify application owners of the changes, integrate automation pipelines, ITSM systems. So we often find that large-about non-human identities essentially are left being unsecured or not addressed. So let me read between lines. What I understand is that PAM is great, but it's not enough. So how can we from OASIS help our audience and are we helping our customers right now? So OASIS takes a three step approach for visibility, context, and then remediation. This is the core of our system. So the OASIS platform discovers and inventories all of your service accounts, service principles, APIs, and tokens, secrets, everything into single pane of glass. Then on top of that single pane of glass, we ran to the contextual visibility into who consumes each identity, help you discover who is the owner, and highlight which identities don't meet your organizational policies. Finally, we'll be able to help you remediate and safely automate rotation using our consumer monitoring capabilities, leverage your existing secret managers, automatically notify the owners and integrate into your existing ITSM system, making sure you hit your security goals all while maintaining operational continuity throughout. Finally, OASIS can also help you move up the security lap, so adopt better practices such as Just-in-Time Access, Identity federation, and other passwordless solutions. I think that was great. A great discussion. Thank you Barak, for sharing your knowledge on service accounts. This has been a great discussion. I'm sure our viewers will now and have now a better understanding of the challenges and importance of managing non-human identities. Thank you, Barak, and thank you all our viewers for being here today.