Discover & remediate existing over-privileged Workload Identities
Implementation Effort: High – Requires coordinated efforts across IT, security, and application teams to audit, assess, and reassign permissions for workload identities, often involving multiple systems and stakeholders.
User Impact: Low – These changes are administrative and do not directly affect end-user operations or require user intervention.
Overview
Over-privileged workload identities, such as service principals and managed identities, are a growing attack surface due to their automation capabilities and lack of interactive sign-in restrictions. These identities often accumulate excessive permissions over time, especially in dynamic environments where workloads evolve rapidly. This task involves auditing all workload identity assignments, identifying excessive privileges, and reassigning roles based on the principle of least privilege. It ties directly to the Zero Trust principle "Use least privilege access," ensuring that non-human accounts only have access to the resources required for their operation. The principle "Assume breach" is supported by reducing the blast radius if a threat actor compromises a workload identity. While this task does not require user interaction, it is foundational to protecting cloud environments and enforcing governance at scale. Failure to perform this activity increases the risk of lateral movement and privilege escalation by threat actors exploiting overly permissive service principals.