Topic starter
08/12/2025 10:02 am
TL;DR: Ransomware incidents such as Colonial Pipeline exposed a deeper problem than malware alone: old credentials, missing multifactor authentication, and standing access let attackers move through critical systems, according to Britive Team. Zero trust only works when teams remove persistent access and treat identity as the perimeter.
Editorial analysis by NHI Mgmt Group, based on content published by Britive: “The Ransomware Crime Wave Has Made Zero Trust Critical”.
Key questions
Q: What breaks when remote access still depends on persistent VPN credentials?
A: Standing VPN credentials create revocation and reuse problems.
Q: Why does multifactor authentication not solve ransomware risk by itself?
A: MFA reduces the value of a stolen password, but it does not remove access that should have been revoked in the first place.
Q: What are the warning signs that zero standing privilege is missing?
A: Common signs include VPN accounts with no current owner, dormant admin access that still works, contractor accounts left active after project end, and access records that do not change with employment status.
Practitioner guidance
- Audit standing remote access first Identify VPN, admin, and third-party accounts that remain valid after role change, termination, or contract end, then remove any access that has no current business owner.
- Convert persistent access to task-scoped access Replace always-on entitlement with just-in-time permissions for elevated work so that access expires when the task ends instead of remaining available for reuse.
- Tie offboarding to access revocation Make leaver processing trigger revocation across identity stores, remote access, and privileged pathways at the same time, not as separate administrative steps.
Bottom line: Ransomware is often enabled by identity governance failure, not just by malware or perimeter weakness.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:26 pm
Zero standing privilege is the real control lesson, not stronger perimeter theatre. This article shows that ransomware operators do not need to defeat every barrier when a valid credential is still trusted after the access relationship has ended. The failure is persistence of entitlement, not merely weak login hygiene. For practitioners, the implication is that access lifecycle discipline matters more than adding another layer around an already stale account.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
Q: How should security teams respond when third-party access is part of the ransomware path?
A: They should treat supplier access like privileged access, not like a procurement checkbox. That means continuous review of vendor entitlements, tighter segmentation around shared accounts, and immediate revocation paths for any third-party route that can reach critical systems.
👉 Read our full editorial: Zero standing privilege is the real lesson from ransomware intrusions