Topic starter
08/06/2026 4:24 pm
TL;DR: APT29’s use of hijacked legitimate accounts, OAuth traversal, and standing access shows why one-time session checks and legacy PAM are weak against modern intrusion patterns, according to StrongDM’s analysis. Continuous authorization, zero standing privilege, and just-in-time access become the control model that matters when attackers operate inside trusted accounts.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “Unmasking Cozy Bear (APT29): The Urgent Need for Continuous Authorization”.
Key questions
Q: What breaks when legacy PAM is used against hijacked legitimate accounts?
A: Legacy PAM often assumes the important security decision happens at session start.
Q: Why do standing credentials increase the risk of lateral movement in cloud environments?
A: Standing credentials remain usable long after the original business need has changed, so an attacker who inherits them can move across systems without re-authenticating.
Q: How do security teams know whether continuous authorisation is actually working?
A: Teams know it is working when sensitive actions are blocked or stepped up based on context, not just login state.
Practitioner guidance
- Replace one-time session approval with continuous checks Evaluate access during the session using context such as device posture, geolocation, role, and resource sensitivity.
- Eliminate standing credentials from high-risk paths Inventory accounts, tokens, and OAuth grants that remain usable after task completion, then reduce or remove them from cloud and admin workflows that do not require persistence.
- Bind elevated access to just-in-time approval Require explicit request, approval, and automatic expiry for privileged actions so reused credentials cannot quietly expand scope across the environment.
Bottom line: The article’s core warning is that attackers can remain effective after initial access when authorization is only checked once and then left alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 6:02 pm
Continuous authorization is the correct control response when the attacker behaves like a trusted user. This article shows that the real failure mode is not simply credential theft, but trusted access that stays trusted after behaviour changes. Once an attacker is inside a legitimate session, static approval models lose their ability to separate ordinary use from hostile use. Practitioners should treat runtime authorization as the enforcement layer, not the exception.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What is the difference between zero standing privilege and just-in-time access?
A: Zero Standing Privilege is the access model that eliminates persistent privilege by default. Just-in-Time access is the operational mechanism that grants permission only when needed and removes it afterward. In practice, ZSP is the policy goal, while JIT is one way to implement it. Teams need both policy and automation to make the model work.
👉 Read our full editorial: Continuous authorization and zero standing privilege for APT29 risk
This post was modified 4 days ago by NHI Mgmt Group