Apr 25, 2025
OWASP NHI5: How to Review Excess Machine Permissions
Compare workload needs, issuer grants, effective access, and observed use before reducing an NHI’s permissions.
Ben Kim
Back to Blog
Tag
OWASP
6 posts
Apr 22, 2025
OWASP NHI4:2025 — how to review insecure authentication
Insecure authentication is more than a leaked key. Review OAuth flows, static credentials, token scope, and the rollout path for safer workload access.
Ben Kim
Mar 3, 2025
OWASP NHI1: Offboard machine access without breaking a service
When a service ends or its owner leaves, decide what still runs, transfer responsibility or revoke access, and verify the old key no longer works.
Ben Kim
Feb 18, 2025
OWASP NHI2: Secret leakage and the four checks after discovery
A leaked secret is a lead, not proof of misuse. Check its location, validity, access, and response owner before closing the exposure.
Ben Kim
Feb 4, 2025
OWASP NHI3: reviewing access held by a third-party integration
A vendor can hold a token that reaches your SaaS data. Use the Salesloft Drift incident and GitHub App controls to review the grant, owner, activity and revocation path.
Ben Kim
Apr 9, 2024
OWASP NHI Top 10: what to check for each machine identity risk
The ten OWASP NHI risks explained through specific checks for service accounts, tokens, deployment systems, and owners.
Ben Kim