TIL that OWASP has a bunch of Top 10 projects other than application security. Some others I found:<p>- Top 10 for LLMs - <a href="https://owasp.org/www-project-top-10-for-large-language-model-applications/" rel="nofollow">https://owasp.org/www-project-top-10-for-large-language-mode...</a><p>- Top 10 for OT - <a href="https://ot.owasp.org/" rel="nofollow">https://ot.owasp.org/</a><p>- Top 10 for Smart Contracts - <a href="https://owasp.org/www-project-smart-contract-top-10/" rel="nofollow">https://owasp.org/www-project-smart-contract-top-10/</a><p>- Top 10 for Open Source Software - <a href="https://owasp.org/www-project-open-source-software-top-10/" rel="nofollow">https://owasp.org/www-project-open-source-software-top-10/</a>
A better link would be the dedicated site for it, also contains introduction which describes what NHI are: <a href="https://owasp.org/www-project-non-human-identities-top-10/2025/" rel="nofollow">https://owasp.org/www-project-non-human-identities-top-10/20...</a>
This focuses mostly more on internal security (i.e after the attacker already has a foothold inside) versus the classic OWASP that are for external front fracing applications
They are using some fancy wording, but this just seems to be about regular service accounts (i.e. "bots") when they are mixed with user accounts in a SoA setting. No AI needed.
I would <i>love</i> to hear about any useful work around leak/abuse-resistance improvements of service accounts and API keys (i.e. the 'NHI' referenced here -- awkward terminology!). Passkeys are a great solution when some kind of end-user interactivity is feasible, and AWS Secrets Manager is supposedly very good if you're entirely on that platform, but for self-hosting, the options seem limited (and things like Hashicorp Vault still don't <i>fully</i> solve the problem)?<p>I recently refactored a moderately complicated system to remove the need for periodic distribution of updated network access credentials, and the best I could come up with were X509 client certificates, which (even if in this case it was a big improvement over the existing state of affairs) feel archaic...
Another good source of NHI definitions, concepts, and threats <a href="https://nhimg.org/the-ultimate-guide-to-non-human-identities" rel="nofollow">https://nhimg.org/the-ultimate-guide-to-non-human-identities</a>
It’s already wise to establish a shared authentication word or phrase with family and colleagues, because AI can now convincingly mimic a person’s face, voice, gestures, even their gait during video calls or phone conversations. A bot won’t know the secret passcode when you ask for it.<p>Within the next 20–25 years, you may need that same safeguard in face-to-face meetings, since Replicants will be lifelike enough to fool anyone.<p>Voight-Kampff Test: <a href="https://youtu.be/IbBfONITYNg" rel="nofollow">https://youtu.be/IbBfONITYNg</a>
Identities are very hard to manage and secure overall. Audits are super long, tedious.<p>Adding more dimensions into reviews that aren't properly done right now will be extremely tricky.
Full title is "OWASP Non-Human Identities Top 10".<p><i>This comprehensive list highlights the most critical challenges in integrating Non-Human Identities (NHIs) into the development lifecycle, ranked based on exploitability, prevalence, detectability, and impact.</i>