The Not So Boring Threat Model of CSP-Managed NHIs

Explore the security risks and vulnerabilities associated with Cloud Service Provider (CSP)-managed Non-Human Identities (NHIs) in this 24-minute conference talk from BSidesLV. Dive deep into the specific threats posed by NHIs across major cloud providers, examining how each provider's unique implementation creates distinct security challenges. Learn about exploits that are specific to different CSP environments and understand how these vulnerabilities can be leveraged by attackers. Build a comprehensive threat model that identifies critical shortcomings in current NHI management practices while discovering practical mitigation strategies to strengthen your cloud security posture. Gain insights into the often-overlooked security implications of automated identities and service accounts that operate without human oversight in cloud environments.