CyberArk research finds 82 machine identities per human
Original title: Building incident playbooks for machine identity breaches
CyberArk analysis shows machine identities outnumber human ones 82 to 1, requiring specialized playbooks for their management and breach response.
Most SOC playbooks focus on human account breaches, but machine identities like service accounts and API keys are far more numerous and harder to detect. CyberArk research indicates 82 machine identities for every human identity. These often lack MFA and hold excessive privileges. Breaches of them can disrupt services without clear ownership. Playbooks should focus on inventory, blast radius assessment, and pre-approved revocation procedures for high-privilege identities.
- CyberArk research: 82 machine identities per human
- Few machine identities use MFA
- High-privilege service accounts common
- Background traffic evades detection
- Need inventory and blast radius sorting
- Vendors
- CyberArk
From the original article
7 min read at csoonline.com
Pull up your SOC’s compromised account playbook and read through the first 15 minutes. Most SOCs begin their response by calling or messaging the user via Teams to ask whether the 2:00 am sign-in from an unfamiliar country was indeed them. Their subsequent actions depend upon what the user responds with.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.