Each engineering system keeps its own users, tokens and collaborators, and few teams can list them all. The more identities with write or admin rights, and the longer they live after people leave, the more accounts an attacker can take over.
- Inventory every human and programmatic identity in each system, with its identity provider, granted permissions and permissions actually used.
- Manage identities through the central identity provider rather than local accounts, and require strong second factors.
- Remove unused permissions, disable stale accounts after a set period, and give outside collaborators access that expires.
- Avoid shared accounts, self-registration, broad default permissions and personal email addresses on engineering systems.
Guides on this site
Gaps on this site
The source repository guide covers organization 2FA, least-privilege roles and quarterly access reviews on GitHub. No guide here inventories identities across CI servers, registries and deployment tools, or shows how to find stale ones.
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.