Standing access is the risk that never makes it onto the risk register
Every infrastructure post-mortem contains the same paragraph, and it is never the one anyone expected to write. The initial access was not sophisticated. It was a credential that existed, that worked, and that nobody had a reason to look at — because it had been legitimately issued months earlier, for a reason that had since ended. That is standing access. It is not a vulnerability, so no scan…
Standing access is a risk that often goes unrecorded in the risk register. It occurs when an individual receives a credential that was authorized for a specific reason, but that reason has since been completed or ended. This type of access is not detected by scanning tools or posture reports because it does not involve a vulnerability or misconfiguration.
Standing access is the consequence of many reasonable decisions made during the authorization process, such as adding a key for a migration, sharing a password during an outage, or providing a kubeconfig to a contractor who has since left the organization. The distribution of credentials is problematic because they are typically copied rather than granted, making it difficult to track and manage their usage.
Credential revocation becomes an investigation rather than a straightforward operation, as there is no way to determine if a credential was removed when it was supposed to be. Few organizations can prove that access truly ended when claimed, often discovering the issue during an audit or due-diligence review. Traditional solutions like configuration management and bastion hosts provide partial protection but do not offer complete visibility into access usage.
Short-lived certificates can improve security by automatically revoking credentials, but implementing them requires significant effort and resources. The ideal solution is to grant access per session, scoped to a specific task, and enforce expiration through a system rather than relying on human memory. This approach would eliminate the need to manually track and manage access, making it easier to prove that access ended when it was supposed to.
Pricing models for access control tools often focus on the number of protected resources, which can lead to increased costs as infrastructure grows. However, the true value of access control lies in managing the number of people who can access production, a factor that remains relatively stable. Pricing per seat better reflects the actual risk and value delivered, making budgeting and forecasting more accurate.
Ultimately, the goal is to have a system in place where it is possible to quickly determine who can access production at any given time, and to provide verifiable evidence of access termination. This level of visibility and accountability is currently lacking in most organizations, despite being a lower bar than what the market typically demands.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
