Compromised user account

Artifact Security Cloud Security Infrastructure as code SCM Posture

A compromised user account is a serious security threat, as attackers can use it to bypass security measures that are in place to protect an organization's assets.
Attackers can gain access to legitimate user accounts in several ways, including brute-force attacks, phishing, malware, or social engineering.
Once an attacker gains access to a user's account, they can access the cloud resources, artifact repository, infrastructure-as-code templates, or source code repository to steal or modify sensitive data or launch further attacks.
In such case an attacker is able to modify the code and cloud resources, inject malware or backdoors, or replace legitimate artifacts.
This can result in data breaches, system downtime, reputation damage, and financial losses.

Where this idea came from

Security research

Identified in published CI/CD or supply-chain security research cited below.

Mitigations

M1130 Implement password rotation
M1131 Disable or lock compromised accounts
M1132 Enable MFA for user accounts
M1450 Implement zero trust
M1451 Use network segmentation
M1550 Implement strict access control for clouds
M1661 Revoke user permissions

Detections

D1130 Implement account activity monitoring
D1131 Implement SIEM
D1510 Implement Intrusion Detection System and anti-malware
D1520 Implement endpoint detection and response system

Compromised user account

Where this idea came from

Mitigations

Detections

Observed in incidents (31)

References