The process of regularly changing or updating the credentials used by Non-Human Identities (NHIs) to enhance security.
Description
Credential rotation is a critical security practice that involves the periodic updating of authentication credentials associated with Non-Human Identities (NHIs), such as service accounts, application identities, and automation scripts. NHIs often operate without human intervention, making them attractive targets for attackers. By rotating credentials, organizations reduce the risk of credential compromise and unauthorized access. This process typically includes changing passwords, API keys, and tokens at defined intervals or after certain events (e.g., suspected breach, personnel changes). Implementing credential rotation helps to ensure that even if credentials are exposed, their usefulness is limited by the rotation schedule. Additionally, automating the rotation process can minimize operational overhead and reduce the potential for human error. Effective credential rotation policies should also include monitoring for credential usage to detect anomalies and ensure compliance with security standards.
Examples
- A cloud service account password is changed every 30 days as part of a security policy.
- API keys for an application are rotated automatically using a secret management tool.
Additional Information
- Credential rotation can be part of a broader Identity and Access Management (IAM) strategy.
- Automation tools can facilitate the rotation process to ensure it is seamless and less prone to errors.
References
- Non-Human Identity Management - Veza
- The Complete Guide to the Growing Impact of Non-Human Identities ...
- Need For Non-Human Identity Protection Is On The Rise
- A Human's Guide to Non-Human Identities (NHIs) - Aembit
- What are Non-Human Identities (NHIs), and how do we secure them?
- Security Operations for Non-Human Identities - The Hacker News
- Securing non-human identities in AWS environments (and beyond)
- As Non-Human Identity Attacks Soar, Cloud Security Alliance and
- Securing non-human identities: Why fragmented strategies fail