Non-Human Identities: An Overhyped Old Concept
Lately, there's been a lot of chatter in the security community about non-human identities—API tokens, service accounts, bots, certificates, you name it. People are considering these as a new threat vector we've just discovered. But let's be real: non-human identities aren't new. Is the security industry overcomplicating non-human identities? Absolutely. They've been part of IT environments for decades. The real issue isn't their existence; it's how the conversation around them has been twisted. Instead of focusing on the basics of identity and access management, the industry is chasing the latest buzzwords. So let's take a step back and talk about what's really going on with non-human identities in the security industry.
Non-Human Identities: Not a New Frontier
If you've been in IT or security for any length of time, you know we've always dealt with identities that aren't tied to a person. Service accounts, machine-to-machine communications, automated processes—they've been around since the early days of computing. Remember Unix systems using service accounts to handle routine tasks? That was long before the cloud, microservices, or today's complex architectures even existed.
So why all the fuss now? Because modern infrastructures have gotten a lot more complex. Cloud deployments, AI-driven applications, IoT devices, microservices—they've all led to an explosion in the number of non-human identities in our environments. But here's the thing: this isn't some new frontier. It's a scale problem, plain and simple. Yet the industry is framing it as a novel challenge, which only leads to confusion and, frankly, overhyped solutions that complicate things more than they help.
We've always managed identities belonging to software rather than people. The difference now is they've multiplied, making good governance and lifecycle management more critical than ever.
The Real Problem: Scaling IAM Practices
Non-human identities aren't suddenly appearing out of nowhere. What's new is the sheer number we're dealing with. With cloud services, containerized environments, and automated CI/CD pipelines, organizations are juggling thousands—maybe even tens of thousands—of non-human identities, each with its own access needs. That's where the real challenge lies. It's not about inventing new frameworks or security solutions; it's about scaling up what we already know about identity governance to meet this new level of complexity.
Let's face it—if you're responsible for security in your organization, you're probably already using IAM principles. But chances are, you haven't extended them to non-human identities as much as you should have. And that's where we need to focus. The principle of least privilege, for example, should apply to non-human identities just like it does to human users. Yet we keep seeing service accounts or API tokens with way more access than they need, simply because no one is auditing them regularly. Remember the Capital One data breach in 2019? Classic case of overprivileged non-human identities leading to a major security incident.
The problem isn't conceptual; it's operational. As the number of non-human identities has exploded, we've fallen behind in applying IAM practices at scale. Instead of treating non-human identities as a novel issue, we need to focus on better governing and managing them—making sure the right processes are in place to control access, monitor usage, and handle lifecycle transitions like creation, modification, and deactivation.
Stop Overcomplicating a Simple Issue
In the rush to tackle the challenges of non-human identities, the industry has a habit of overcomplicating things. New solutions marketed as "non-human identity management" often just repackage existing IAM principles with fancier terms or extra layers of abstraction. Sure, these tools can offer some value, but they sometimes add unnecessary complexity to identity management—complexity that distracts from applying tried-and-true practices.
This overcomplication can actually be harmful. When companies invest in complex tools without fully understanding the underlying problem, they might miss the mark on core IAM practices like access reviews, privilege reduction, and credential rotation. What organizations really need isn't more buzzwords or overhyped solutions; they need to focus on the fundamentals. Many of these new solutions claim to solve novel problems, but at their core, they're just addressing the growing scale of non-human identities—not the concept itself.
Let's Get Back to Basics
Instead of chasing the latest and greatest tool, companies should look at how they can extend their existing IAM frameworks to cover non-human identities more effectively. The solutions aren't as complicated as some might have you believe. The principles of IAM are the same, whether you're dealing with human or non-human identities. The key difference is how we apply them to today's increasingly complex and large-scale systems.
Here are some fundamental practices that are crucial for managing non-human identities:
Identity Governance
Identity governance is essential for maintaining control over all identities, human or not. It means setting up policies, automating processes for managing identities, onboarding and offboarding, and making sure those policies are enforced. For non-human identities, this might involve ensuring each service account or API token has clearly defined roles and permissions that are regularly reviewed. Without governance, you risk losing visibility into who—or what—has access to critical resources in your network.
Least Privilege
The principle of least privilege is straightforward: an identity should have only the access it needs to perform its function, and nothing more. This applies to non-human identities just as much as to humans. Unfortunately, many organizations overlook this when it comes to service accounts or API tokens, letting them operate with broad, unchecked privileges. Over time, this can lead to significant security risks, especially if those accounts get compromised.
Credential Rotation and Access Reviews
Another common issue is the lack of regular credential rotation and access reviews for non-human identities. Often, service accounts or API tokens are set up with static credentials that never expire, making them easy targets for attackers. IAM best practices dictate that credentials should be rotated regularly and that periodic access reviews should be conducted to ensure these identities still need the permissions they were initially granted. This is basic security hygiene, but it's often neglected for non-human accounts.
In many cases, the simplest solution is the most effective. Rather than adopting complex, overhyped solutions, focusing on extending basic IAM practices to non-human identities can solve many of the challenges organizations are currently facing.
Correcting the Industry Narrative
One of the biggest challenges we face is the disconnect between the hype and reality. Many companies and vendors present non-human identities as if they're groundbreaking discoveries. The reality is, they've always been part of the security landscape. What's changed is the scale and complexity of the environments they operate in.
This hype cycle often leads organizations to focus on the wrong priorities. They might feel pressured to invest in flashy solutions for a problem that could be solved by revisiting their existing security policies and practices. The result? Unnecessary investments and, sometimes, more risk due to the increased complexity of managing these new solutions.
The Conversation We Should Be Having
We need to shift the conversation away from the "discovery" of non-human identities and focus on refining how we manage them at scale. The question isn't "How do we solve the problem of identity?"—because that problem isn't new. Instead, we should be asking, "How can we better govern these identities in a cloud-native, highly automated environment?" As an industry, we need to critically examine our approach to non-human identity management:
Are we genuinely solving the root problems, or just adding layers of complexity?
How can we translate awareness into effective action?
What changes do we need to implement zero trust principles for these system accounts, even in legacy systems?
So, how can we improve our posture and secure non-human identities without getting lost in the hype? Here are a couple of practical steps:
Leverage Secrets Management Solutions
Hardcoding credentials is a disaster waiting to happen. Instead, use dedicated secrets management tools to store and manage these credentials securely. They allow you to control access to sensitive information, rotate credentials automatically, and audit who's accessing what. Integrating these tools into your applications and deployment processes minimizes the risk of credential leaks and unauthorized access.
Policy as Code for Permissions
Manually configuring permissions is outdated and risky. Instead, consider adopting "policy as code" by defining your access policies using code and version controlling them like any other software. This approach brings consistency and repeatability to your IAM practices, reduces human error, and makes auditing ez. Plus, integrating these policies into your deployment pipelines ensures that access controls are applied automatically whenever new service accounts are created or updated preventing overprivilege in many cases.
Offboard Non-Human Identities
Just like with human employees, it's crucial to properly offboard non-human identities when they're no longer needed. Leaving these identities active can create security holes, as they might retain access to sensitive systems or data. Regularly auditing and removing unused service accounts, API tokens, and other NHIs helps minimize your attack surface and prevents potential misuse by unauthorized parties.
By focusing on these core principles, we can manage the security risks associated with non-human identities without getting caught up in the hype or investing in overly complex solutions.
Conclusion
The conversation around non-human identities has reached a point where it needs correcting. We'll undoubtedly see more non-human identities in our networks in the future, but the principles of IAM remain the same. Now, I'm not saying these new tools are worthless. They have their place, but they should enhance, not replace, the IAM fundamentals we already have and they should have a long-lasting impact rather than just providing monitoring. At the end of the day, no tool can compensate for poor IAM practices. The principle of least privilege is the bedrock of security—whether the identity is human or not. Let's focus on what we know works and keep security simple, effective, and grounded in fundamentals.