Definition
Machine credentials such as service-account keys, integration tokens and API keys authenticate systems rather than people. They are typically long-lived, broadly scoped, and copied wherever a workload needs them.
Why they escape identity governance
Human identity has a lifecycle: joiners, movers, leavers, periodic access review. Machine identity often has none of that. A key created for a migration can outlive the migration, the project and the person who created it, while retaining privileges chosen for convenience at the time.
Where the copies accumulate
- Source repositories and their history
- CI configuration and build logs
- Container images and infrastructure templates
- Local developer environments and shared documents
- Third-party integrations configured once and never revisited
A leaked credential only matters if it works. That is the question worth answering, and it is answerable.
- Repository / System
- Service Key
- Cloud / SaaS Account
- Privileged Resource
Each hop validated by successful exploitation
Tags
- secrets
- service accounts
- credentials