Share these talks and lectures with your colleagues
Invite colleaguesPractice paper
Analysing and managing risk from third-party OAuth application access
Cyber Security: A Peer-Reviewed Journal,
7
(4),
342-362
(2024)
Abstract
Modern cloud application architectures allow users to dynamically grant third-party apps access to their cloud resources. When looking at a large, anonymised dataset of over 600,000 users and their approvals of over 43,000 applications, we found that organisations often are unaware of the magnitude of the access problems: on average, an organisation will grant 440 unique third-party apps access to Google data and resources; one organisation’s users approved 12,330 unique applications; out of all the approved applications, over 44 per cent have been granted access to either sensitive data or all data on the user’s Google Drive. The use of OAuth 2.0 has resulted in users creating numerous, unknown access paths from external third-party apps to organisations’ data and resources, in a way that is often hidden and unmanaged by organisations’ IT or security departments. In addition, the credentials granted to access users’ cloud data and resources often can be refreshed indefinitely. Security operations face challenges such as minimal to no tracking or management of these paths or credentials, along with immature or incomplete technical controls. This paper discusses an approach to understanding, assessing, analysing and managing third-party OAuth application risk, using anonymised real-world data as relevant examples, to provide prescriptive guidance on reducing risk associated with third-party applications.
Keywords: OAuth; identity; data access; third-party cloud applications
The full article is available to subscribers to the journal.
Author's Biography
Jenko Hwong is a Principal Researcher on Netskope’s Threat Research Labs, analysing emerging cloud threats. He has over 20 years’ experience in research, product management and engineering at companies such as Cisco and TIBCO, as well as security start-ups in markets such as vulnerability scanning, anti-virus/anti-spam appliances, penetration testing, threat intelligence and Active Directory security. He has successfully founded a start-up in the enterprise monitoring market and has led production deployments at enterprise customers including Walmart, Microsoft, Lucent and Chase. He holds a BSc in computer systems engineering from Stanford University.
