Machine Identity & Attack Path: The Danger of Misconfigurations

The talk opens by defining machine identities, such as service accounts, tokens and secrets used by applications, containers and pipelines, and contrasts them with human accounts. The speaker argues that a high-value target is not only an executive but anyone whose identity carries broad permissions. A Brazilian financial fraud case illustrates the point: a junior developer with excessive rights and no just-in-time access became the facilitator of the attack.

The middle section walks through AWS identity and access management, covering policy statements, effects, actions and resources, and why wildcard resources are risky. A live demonstration shows how read-only credentials can enumerate users and policies, and how a single permission to create policy versions lets an attacker grant themselves wider access, eventually at the organization level. Attack paths are presented as graphs, where a chokepoint is a single fix that cuts many routes to a high-value identity.

To close, the speaker recommends open-source mapping tools such as Cartography, AWSPX and SecBridge, which need only read-only access to build identity graphs, and mentions a free community edition of a commercial graph platform. Audience questions covered using access logs to strip unused permissions, and whether AI agents that run around the clock weaken just-in-time controls. The suggested answer was behaviour analytics. The main takeaway is to apply least privilege and review every permission.