InfoSec

12 guides tagged “InfoSec”.

  1. How to Inventory Non-Human Identities An NHI inventory lists every credential, owner, scope, and last use. Start with APIs that already know, then fill gaps with code scanning. Information Security intermediate 5 min
  2. Non-Human Identities in CI/CD: Where They Leak CI concentrates production credentials: repository secrets, deploy keys, cloud keys, and tokens in logs. Most leaks happen in the pipeline, not the app. Information Security intermediate 5 min
  3. The Non-Human Identity Lifecycle Request, issue, use, rotate, review, revoke. Most organisations have the first two stages and skip the rest, which is why credentials accumulate. Information Security intermediate 5 min
  4. Service Account vs API Key: Which Should You Use? A service account is an identity with permissions; an API key is a bearer credential. Confusing the two leads to keys with more access than needed. Information Security intermediate 5 min
  5. What Are the Types of Non-Human Identities? Service accounts, API keys, OAuth clients, certificates, workload identities, and agent tokens differ in lifetime and in the control that matters. Information Security beginner 5 min
  6. What Is a Secrets Manager (and Do You Need One)? A secrets manager stores, controls, audits, and can issue short-lived credentials. It earns its cost once several services or people need a secret. Information Security beginner 5 min
  7. What Is a Stale Non-Human Identity? A stale NHI is a credential nobody uses but that still authenticates. It is a standing backdoor with no owner and no expiry. Information Security intermediate 5 min
  8. What Is SPIFFE and SPIRE? SPIFFE is an identity standard for workloads; SPIRE is its reference implementation. Together they replace shared secrets with attested certificates. Information Security advanced 5 min
  9. What Is Workload Identity? Workload identity gives a process a short-lived credential based on what it is, not a static secret it carries. It removes the key from the deploy path. Information Security intermediate 5 min
  10. What Is XXE (XML External Entity Injection)? XML parsers can be told to fetch external resources. XXE abuses that to read local files, probe internal networks, and in some configurations cause denial of service. Information Security intermediate 6 min
  11. Secret Scanning vs SAST vs DAST: Which Do You Actually Need? Three scanners that get installed interchangeably: one finds committed credentials, one reads your code for flaws, one attacks the running app. Different inputs, different findings. Information Security beginner 6 min
  12. What Is Server-Side Template Injection (SSTI)? Template injection happens when user input is rendered as template code rather than as data, letting an attacker run expressions and often reach remote code execution. Information Security advanced 6 min