Emerging threats against cloud application identities and what you should do about it
summary
Workload identities are an increasing attacker target: 34% of orgs report incidents from malicious applications, 26 million logins leaked, and 74% unaware of their keys and certificates. Demos use Azure Identity Protection, conditional access and sign‑in/audit logs to detect leaked creds, risky workload identities and unusual geo/time patterns; access reviews and managed identities replace hardcoded strings. Real incidents include exposed APIs and SolarWinds-style lateral movement via over‑privileged service principals. Defenses: least privilege, short credential lifetimes, lifecycle cleanup, rotate secrets and run an incident response eviction when needed.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 1:05About Sarah Young
- 3:47What is an application identity
- 6:10Principle of least privilege
- 9:09Service to service
- 10:14Nonhuman identity
- 14:23Statistics
- 15:43Solargate
- 17:45Consent phishing
- 19:27GitHub keys
- 20:56Main threats
- 22:32Phishing emails
- 23:56Leaked credentials
- 25:01Sign in logs
- 26:30Audit logs
- 27:40Leaked creds
- 28:48What to do
- 31:18Containment
- 32:43Remediation
- 33:10Proactive use
- 34:46Summary
- 37:47Permissions
- 39:30Demo
related talks
24mChaos to Control: Automating the Identity Life Cycle in the Cloud
45mApplying Past Lessons for Intel-Driven Identity Threat Detection
12mIdentity and permissions concerns to watch out for
23mAccess is the New Breach: Observability Must Start with Identity
55mAzure Attacks Unpacked: Real-World Threats & Lessons
52mUncovering Azure's Silent Threats: A Journey Into Cloud Vulnerabilities
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
31mCloud Threat Landscape - 2021