Why machine identity breaches need their own incident playbooks
- Severity
- Low
- Sources
- 1
What happened
Machine identities outnumber human ones by roughly 82 to 1 (CyberArk), and few sit behind MFA. Cloudflare's Thanksgiving 2023 incident involved an access token and three service account credentials taken in the Okta support breach; four credentials were missed during rotation and the first alert came over a week after login, when a service account was added to an administrator group. Microsoft's Midnight Blizzard case involved a password spray against a legacy test tenant account without MFA and an unused test OAuth app with elevated access. Defenders should build a machine identity inventory with owners and removal impact, tier identities by blast radius, pre-authorise revocation roles, enable cloud audit logging, and triage using location and permission data rather than user confirmation.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Build an inventory of high-privilege service accounts, API keys and OAuth apps, recording the owning team and what would fail if each were removed.
- Pre-authorise by name who can approve immediate revocation of high-tier machine identities, even if it disrupts a service.
- Remove or rotate credentials and OAuth apps that are no longer needed, including those issued for finished projects.
- Confirm cloud audit logging is turned on for machine identities so that sign-in location and permission changes can be checked.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors
Companies
Products