Entro Security
NHIDR (Non-Human Identity Detection & Response)
Entro’s platform goes beyond straight-forward monitoring. Entro’s Non-Human Identity (NHI) Detection and Response technology allows organizations to detect and respond to:
Compromised NHIs: By establishing behavioral models and tracking secret utilization in real-time, NHIDR instantly detects when secrets are being misused or Non Human Identities (NHI’s) are being abused.
Unauthorized access attempts: detect interactions involving NHIs and vaults from suspicious geolocations
Vault Dumps: to immediately stop mass downloads of secrets
Human interactions with vaulted secrets: to stop secret exposure at the source
Examples of risks Entro Detects and Responds to:
- MongoDB token is used from a suspicious source IP address
- Ex-employee token is used by suspicious actor IP
- Secret was retrieved by a suspicious actor
- Sensitive secret revealed by a human action
- production secret fetched by human outside reasonable work hours
- Idle identity fetched a production secret
- Previously disabled token has been reactivated
- Previously inactive token is now active again
- Production token is used by IDE client
- Secret was fetched by a new workload
- Too many entities are fetching the same secret
In order to accomplish all these goals, Entro’s NHIDR technology reviews all past context and logging to:
- Establish a baseline of typical behaviors of each NHI with historical behavioral context in order to identify anything out of the ordinary. Anomalies are then highlighted with context for investigation purposes.
- Detect day 0 threats and anomalies, going beyond a simple inventory to real-time, continuous analysis of secrets behavior.
- Respond immediately to isolate and mitigate anomalous behavior.
- Integrate effectively with your existing task management, automation, and alerting solutions
- 24/7/365 monitoring of future interactions with NHIs, Secrets, and Vaults.
This proactive approach ensures that security incidents are addressed in real-time, reducing potential breaches before they occur. Entro also automates the remediation process by rotating or revoking compromised tokens, thus minimizing the manual effort needed to secure environments.
