SlashID provides identity management solutions for users and non-human identities, focusing on secure, compliant, and scalable identity infrastructure.

SlashID

SlashID | 1,773 followers on LinkedIn. The identity stack to protect users and non-human identities. | The identity stack to protect users and non-human identities.

Principal Engineer at SlashID

João Moreira Fernandes

CTO at SlashID

Giovanni Gola

VP of Sales | Enterprise Software | Board Member | Leadership | Identity

William Easton

Principal Engineer at SlashID, Co-Founder of Three Dots Labs

Robert Laszczak

We are pleased announce the NHI Mgmt Group has now established key Strategic Partnerships with 15 Companies to help create greater awareness of the Risks and Challenges in managing Non-Human / Machine / Workload Identities. Entro Security Astrix Security Oasis Security SlashID P0 Security Corsha GitGuardian Andromeda Security Unosecur AxisNow Whiteswan Identity Security TrustFour Technologies Natoma Aembit Clarity Security By supporting the work we are doing within our NHI Community Organisation, we are able to provide Education, Awareness, Guidance, Advice, Best Practices for organisations trying to address one of the biggest security risks in the industry. Visit our NHI Mgmt Group portal https://nhimg.org for : ▶ Further details on the Products and their capabilities. ▶ Knowledge Centre including NHI Articles, White-Papers, Blogs, Research, Industry Surveys, Animated Videos and Newsletters. Lalit Choda - Group Founder Please note the slides in the video have been provided directly by our strategic partners and don't represent in any way the opinions of the NHI Mgmt Group #nonhumanidentity #machineidentity #workloadidentity #iam #nhis #nhim #identitymangement

Lalit Choda

In recent weeks, I've been spending more time meeting with new NHI vendors. One of the more impressive identity solutions I've encountered is SlashID , founded by ex-crowdstrike expert Vincenzo Iozzo . What I found impressive about their solution is how their product intersects across NHI, ITDR, and Identity Attack Surface Management (IASM). SlashID solutions cover visibility, detection, and remediation for NHIs. More importantly, I liked their emphasis on anomaly detection, which sets them apart from more static monitoring competitors. I wrote more about them in my NHI report. https://lnkd.in/gFCuCARz ** Also, I added some new analysis on Oasis Security solution after reviewing their approach recently. My NHI report now has the most complete analysis of all the key vendors across NHI security. I'll speak on this vendor landscape at the upcoming NHI summit later today: https://lnkd.in/ghvBVSwE

Francis Odum

Continuing the thread on identity attacks, federation abuse, and token forgery are some of the most commonly used techniques for Lateral Movement and Privilege Escalation. We’ve encountered these before with attacks like Kerberoasting and Golden Tickets. More recently, the 2023 Storm-0558 attack on Microsoft Exchange and the MGM hack reminded us how dangerous these attacks can be—and how hard they are to spot, even in cloud environments. Here's a recap of the most common vectors and patterns we've seen in the wild: https://lnkd.in/e2qjPnmx

Vincenzo Iozzo

We are pleased announce the NHI Mgmt Group has established a number of key strategic partnerships with a number of companies to help create greater awareness of the Risks and Challenges of managing Non-Human / Machine Identities, by supporting the work we are doing within our NHI Community Organisation to provide Education, Awareness, Guidance, Advice, Best Practices for organisations trying to address one of the Biggest Security Risks in the industry. Entro Security Astrix Security Oasis Security SlashID P0 Security Corsha Andromeda Security Whiteswan Identity Security TrustFour Technologies Natoma Aembit Clarity Security Please find full details of this announcement in our newsletter. ▶ Join the LinkedIn Group https://lnkd.in/etwh6Yqt ▶ Visit the Community Portal https://nhimg.org ▶ Subscribe to our Newsletter https://lnkd.in/eS4h3Vkk Lalit Choda - Founder of the NHI Mgmt Group #nonhumanidentity #nhis #nhim #machineidentity #workloadidentity #iam #identitymangement

Recent high-profile breaches and more campaigns from APT groups such as APT28, APT29, and Scattered Spider highlight a growing focus on NHI-related TTPs. With an influx of vendors looking at the problem from different angles, we try to answer the question: What’s wrong with NHIs, and how can we fix it? Key Challenges with NHIs: 1. No enforcement of MFA 2. Difficult credential rotation 3. Poor lifecycle management—unclear access, de-provisioning challenges, and no definitive “source of truth” 4. NHIs tend to be over-privileged due to the sheer number of entitlements available in most cloud environments As a result: 1. Due to the lack of MFA and sprawl of credentials, attackers are targeting them more 2. MTTR is very high, in particular for credential rotation 3. Because NHIs are so often overprivileged, privilege escalation and lateral movement are much easier to achieve Would love feedback on this!

Last week, I had the pleasure to sit down with Patrick Gray and talk about what we've been up to at SlashID . Identity is the most important topic to work on in security right now and we are trying to make the problem more tractable. Looking at historical data on data breaches, three vectors emerge clearly: 1. Weak credentials in unfederated apps 2. MITM/AiTM and phishing attacks 3. Stolen/lost key material, in particular for service accounts/NHIs Tune in to hear our approach to address these threat vectors and remediate them quickly without overworking your SOC and identity teams: https://lnkd.in/eE9SjvfE

Solid research using Canary tokens to understand attack patterns on leak credentials. On most services, it takes less than 50 minutes from leak to attempted access and less than 60 seconds on npm! Two interesting things to note: 1) Most IPs used by the attackers were clean. Only 9 were marked as suspicious or malicious so most traditional IP-based detections would not have helped at all here. 2) InvokeModel (this invokes a machine learning model via AWS Bedrock) as one of the most common actions performed after the initial breach. It is unclear if the motivation was LLMjacking or something else. This is also a less commonly monitored action so less likely to be spotted by a security product. Keeping secrets safe and high signal detections are key. https://lnkd.in/e-EgBDwZ

When it comes to human/user credentials, MITM/AiTM attacks are one of the most common ways to bypass MFA and steal credentials or session tokens. Further, these attacks are less noisy than stuffing attacks as they generate fewer alerts. I'm happy to say that we have added a new detection to our Identity Protection module to catch MITM attacks! Similarly to the way Thinkst Canary Cloned Website Tokens work, SlashID's MITM detection conceptually works by detecting whether requests are served from an authorized domain. We employ a specially crafted CSS fragment to maximize usability across websites. You can use the detection both on custom websites and on any IdP or third-party application that supports CSS-based login customization - this allows you to protect both your employees and customers. You can use our webhooks or automated response workflow to act on the alert. Read more about it here: https://lnkd.in/edCS_9FZ

On August 15th Palo Alto Network released the details of a large-scale campaign leveraging leaked credentials in env files to compromise AWS accounts. Identity was at the center of the breach. As a textbook example of recon, the attackers enumerated users in the targeted accounts and later leveraged AttachRolePolicy to escalate privileges. In this blog post, we discuss what identity-focused detection and remediation actions you can take to prevent this kind of ransomware campaign in the future. https://lnkd.in/e6GsXYai

On August 15th Palo Alto Network released the details of a large-scale campaign leveraging leaked credentials in env files to compromise AWS accounts. Identity was at the center of the breach. As a textbook example of recon, the attackers enumerated users in the targeted accounts and later leveraged AttachRolePolicy to escalate privileges. In this blog post, we discuss what identity-focused detection and remediation actions you can take to prevent this kind of ransomware campaign in the future. https://lnkd.in/enXtqJUi

SLAS

DEV:SLASHID

SlashID

People Not Available