Token Rotation

Token last rotation is longer than 90 days

Description

Regularly rotating privileged secrets is crucial for protecting your business from malicious attacks. Without rotation, a malicious individual could gain access and use it to cause significant damage. Rotation makes unauthorized access much harder, keeping your organization secure.

Risk triggers

NHI Tokens with an age older than 90 days (by default)
Age thresholds can be configured according to the policies of your organization

Mitigation

Tokens should be revoked and re-created.

Tokens should be constantly rotated to avoid a potential leak, misuse, and lack of compliance.

Inform the token owner that his token should be rotated.
Replace the token in all previous locations it was stored in once it has been revoked and recreated.

JSON Example

Risk JSON

account: {environment: "Niceline", environmentType: "DEMO"}
accountId: "demo1-374807"
accountType: "GCP"
category: "SECRET_HYGINE"
correlationGuid: "NTR-155126"
creationDate: "2024-10-19T20:05:41.984Z"
customData: [{label: "Token",…}, {label: "Rotation age", value: "2024-07-18T09:17:25.000Z"}]
customerId: 34
data: null
description: "If not rotated, secrets with high privileges can be abused unintentionally or by malicious actors. For example, these secrets can be used to destroy or delete data, create more backdoor secrets with high privileges and attack your organization endlessly."
destination: "GCP_SERVICE_ACCOUNT"
guid: "RSK-9875"
hasComment: null
hasJiraTicket: null
hasSeen: false
hasSlackMessage: null
id: 47460
isArchived: false
key: "ROTATE-TKN-1214"
linkedElements: ["TKN-1214"]
logChangeType: null
modifyDate: "2024-10-31T10:09:45.739Z"
name: "Token last rotation is longer than 90 days"
occurrences: ["GCP_SERVICE_ACCOUNT_KEY"]
owner: "james-527@demo1-374807.iam.gserviceaccount.com"
ownerAiObject: null
ownerUid: null
path: "fd6b6854aaa5bb6fff58294518680ad6bc098po"
ruleCode: "TOKEN_ROTATION"
scanId: 3049595
severity: "LOW"
source: "GCP"
status: "OPEN"
tags: ["SOC2", "Niceline test"]
tasks: [{customerId: 34, riskId: 47460, type: "ROTATE_TOKEN", level: "HARD",…}]
type: "ROTATE"

Linked Element (NHI Token) JSON

accessedDate: "2024-10-28T06:23:55.917Z"
account: {environment: "Niceline", environmentType: "DEMO", accountType: "GCP", id: "demo1-374807"}
accountId: "demo1-374807"
accountType: "GCP"
awsPolicies: null
azurePermissions: null
azureRoles: null
correlationGuid: "NTR-155126"
creationDate: "2024-07-18T09:17:25.000Z"
creator: null
customerId: 34
devices: null
guid: "TKN-1214"
infoJSON: "{\"name\":\"projects/demo1-374807/serviceAccounts/james-527@demo1-374807.iam.gserviceaccount.com/keys/fd6b6854aaa5bb6fff58294518680ad6bc098po\",\"validAfterTime\":\"2024-07-18T09:17:25Z\",\"validBeforeTime\":\"9999-12-31T23:59:59Z\",\"keyAlgorithm\":\"KEY_ALG_RSA_2048\",\"keyOrigin\":\"GOOGLE_PROVIDED\",\"keyType\":\"USER_MANAGED\",\"status\":\"Active\",\"serviceAccount\":{\"name\":\"projects/demo1-374807/serviceAccounts/james-527@demo1-374807.iam.gserviceaccount.com\",\"projectId\":\"demo1-374807\",\"uniqueId\":\"109427023720597576258\",\"email\":\"james-527@demo1-374807.iam.gserviceaccount.com\",\"displayName\":\"Eyal \",\"etag\":\"MDEwMjE5MjA=\",\"oauth2ClientId\":\"109427023720597576258\",\"status\":\"Active\"}}"
isActive: false
isAdmin: false
isArchived: false
isIdle: false
isProd: false
lastAccessors: [{info: {ip: "54.173.102.231", agent: "google-api-nodejs-client/6.0.4 (gzip),gzip(gfe)",…},…},…]
lastModifiers: null
lastOwnerAiUpdate: null
liminalCreationDate: "2024-08-22T16:27:13.185Z"
liminalModifyDate: "2024-09-01T13:27:09.635Z"
originAccessMethod: "GCP_SERVICE_ACCOUNT"
owner: "james-527@demo1-374807.iam.gserviceaccount.com"
ownerAiObject: {similarity: 0.9, ownerItemType: "username", elementItemType: "email", originalOwnerValue: "james",…}
ownerSource: "USERNAME"
ownerUid: "b8993373-d7c1-4c3f-ac7e-6e379a4a609d"
riskSeverity: "MEDIUM"
rotationDate: "2024-07-18T09:17:25.000Z"
scanId: 1259284
serviceName: null
status: "Active"
tags: {tags: ["User Managed"]}
tokenId: "fd6b6854aaa5bb6fff58294518680ad6bc098po"
tokenTotalAccess: null
tokenTotalIp: null
tokenTotalUserAgent: null
uid: "569aa1dc-a083-44b9-b15c-8b5898310712"
userAgent: null
username: "james-527@demo1-374807.iam.gserviceaccount.com"