OWASP NHI Top 10 – Environment Isolation
Overview
Environment Isolation refers to separating cloud environments (development, staging, production) and ensuring that non-human identities (NHIs)—such as service accounts, roles, or access tokens—are not shared across them. Failing to isolate environments increases the risk that a compromise in a less secure system (like testing) can propagate to production.
What Is Environment Isolation?
Environment isolation is a core practice for modern cloud security. While each environment serves a different purpose, many organizations still reuse NHIs across them. This creates a risk where an attacker who breaches a lower-tier environment can leverage shared credentials or permissions to pivot into sensitive systems.
For example, if an overprivileged NHI used in testing has access to production resources, any compromise could escalate quickly—bypassing traditional access controls and exposing critical data or services.
How Does Environment Isolation Work?
To enforce secure isolation:
- Assign unique NHIs per environment
- Enforce least privilege by tightly scoping permissions
- Use infrastructure boundaries (e.g., separate subscriptions, VPCs, IAM policies)
- Continuously monitor for cross-environment access anomalies
Proper isolation ensures an attacker cannot exploit a single NHI to bridge between non-production and production systems.
Why Does Environment Isolation Matter?
According to the CSA NHI Report:
- 32% of NHI-related security incidents were caused by configuration errors
- Many incidents stemmed from shared or improperly scoped NHIs
- Attackers often start in dev/test systems where security is more relaxed
Without environment isolation, breaches spread faster, cause broader damage, and evade detection longer. Segmenting NHIs helps contain threats and enforce tighter governance.
Astrix’s Solution for Environment Isolation
Astrix helps you enforce strict environment isolation through:
- Discover Non-Human Identities across all environments with contextual metadata (e.g., environment, role, cloud)
- Detect Suspicious Non-Human Activity that indicates cross-environment usage or abnormal access
- NHI Governance tools that tag, monitor, and restrict NHIs by environment
- Reduce your non-human attack surface by remediating environment violations and enforcing boundary policies
With Astrix, teams can visualize the flow of access across environments and lock down non-production NHIs from reaching sensitive systems.
Are your environments truly segmented? See Astrix in action to enforce identity isolation and eliminate risky overlaps between dev, test, and prod.
Learn more about the OWASP NHI Top 10 framework in Astrix’s introduction to the standard → Introducing the OWASP NHI Top 10.