OWASP Non-Human Identities Top 10

TIL that OWASP has a bunch of Top 10 projects other than application security. Some others I found:<p>- Top 10 for LLMs - <a href="https:&#x2F;&#x2F;owasp.org&#x2F;www-project-top-10-for-large-language-model-applications&#x2F;" rel="nofollow">https:&#x2F;&#x2F;owasp.org&#x2F;www-project-top-10-for-large-language-mode...</a><p>- Top 10 for OT - <a href="https:&#x2F;&#x2F;ot.owasp.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ot.owasp.org&#x2F;</a><p>- Top 10 for Smart Contracts - <a href="https:&#x2F;&#x2F;owasp.org&#x2F;www-project-smart-contract-top-10&#x2F;" rel="nofollow">https:&#x2F;&#x2F;owasp.org&#x2F;www-project-smart-contract-top-10&#x2F;</a><p>- Top 10 for Open Source Software - <a href="https:&#x2F;&#x2F;owasp.org&#x2F;www-project-open-source-software-top-10&#x2F;" rel="nofollow">https:&#x2F;&#x2F;owasp.org&#x2F;www-project-open-source-software-top-10&#x2F;</a>

A better link would be the dedicated site for it, also contains introduction which describes what NHI are: <a href="https:&#x2F;&#x2F;owasp.org&#x2F;www-project-non-human-identities-top-10&#x2F;2025&#x2F;" rel="nofollow">https:&#x2F;&#x2F;owasp.org&#x2F;www-project-non-human-identities-top-10&#x2F;20...</a>

Hah, turns out they&#x27;re talking about stuff like access tokens, not otherkin!

I especially enjoyed NHI10:2025 Human Use of NHI.<p>Time to stop all that pesky human use. Switch off the servers too, just to be sure.

This focuses mostly more on internal security (i.e after the attacker already has a foothold inside) versus the classic OWASP that are for external front fracing applications

They are using some fancy wording, but this just seems to be about regular service accounts (i.e. &quot;bots&quot;) when they are mixed with user accounts in a SoA setting. No AI needed.

I would <i>love</i> to hear about any useful work around leak&#x2F;abuse-resistance improvements of service accounts and API keys (i.e. the &#x27;NHI&#x27; referenced here -- awkward terminology!). Passkeys are a great solution when some kind of end-user interactivity is feasible, and AWS Secrets Manager is supposedly very good if you&#x27;re entirely on that platform, but for self-hosting, the options seem limited (and things like Hashicorp Vault still don&#x27;t <i>fully</i> solve the problem)?<p>I recently refactored a moderately complicated system to remove the need for periodic distribution of updated network access credentials, and the best I could come up with were X509 client certificates, which (even if in this case it was a big improvement over the existing state of affairs) feel archaic...

Another good source of NHI definitions, concepts, and threats <a href="https:&#x2F;&#x2F;nhimg.org&#x2F;the-ultimate-guide-to-non-human-identities" rel="nofollow">https:&#x2F;&#x2F;nhimg.org&#x2F;the-ultimate-guide-to-non-human-identities</a>

It’s already wise to establish a shared authentication word or phrase with family and colleagues, because AI can now convincingly mimic a person’s face, voice, gestures, even their gait during video calls or phone conversations. A bot won’t know the secret passcode when you ask for it.<p>Within the next 20–25 years, you may need that same safeguard in face-to-face meetings, since Replicants will be lifelike enough to fool anyone.<p>Voight-Kampff Test: <a href="https:&#x2F;&#x2F;youtu.be&#x2F;IbBfONITYNg" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;IbBfONITYNg</a>

Identities are very hard to manage and secure overall. Audits are super long, tedious.<p>Adding more dimensions into reviews that aren&#x27;t properly done right now will be extremely tricky.

Wtf? We have been calling these workload identities for years.

Sorry but can anybody explain what Non-Human Identities are?

Based on the title and the first few paragraphs, I expected this to be about risk of datacenter security breaches by Bears, and the like.

Full title is &quot;OWASP Non-Human Identities Top 10&quot;.<p><i>This comprehensive list highlights the most critical challenges in integrating Non-Human Identities (NHIs) into the development lifecycle, ranked based on exploitability, prevalence, detectability, and impact.</i>