Do service accounts and API tokens need monitoring too?

Yes, and they are often the least watched accounts in the company. Service accounts run backups, scans, integrations and scheduled jobs, often with broad rights, passwords that never change and no multi-factor authentication. API tokens and keys for cloud services sit in scripts, configuration files and code repositories, where an attacker who finds one can use it from anywhere. Keep an inventory with an owner for each, give them only the rights they need, store secrets in a vault rather than in files, rotate them on a schedule and immediately when someone with access leaves, restrict where they may be used from, and alert when one is used from an unusual place or at an unusual time; your identity and cloud logs show that. On the network, a service account is always used from some host: NetSenX flags that host when it starts new sessions to other hosts, scans or uploads unusually much, on every plan. It does not see the token itself inside encrypted traffic.

← All 45 questions on Zero trust, identity and segmentationAll topics