Least-Privilege | Attack Surface Reduction Manifesto

Capital One

Over-broad credentials turned an SSRF flaw into 106 million records

A firewall misconfiguration exposed the metadata service, and the IAM role it handed back could read the customer-data buckets.

NASA OIG

Cut local admin accounts from 13,875 to 5,385

A 2026 audit found NASA's process for workstation administrator rights effective, with deprovisioning keeping pace with provisioning.

Twitter

Left an internal admin tool behind employee accounts

Attackers socially engineered Twitter employees to reach an internal admin tool; just-in-time access would have limited what the compromised accounts could do.

Uber

A contractor account nobody deprovisioned started the breach

An attacker bought a contractor's corporate password on the dark web, and the account still worked because it had never been closed.

DHS OIG / CBP

Found all 76,000 network users could reach one privileged account

A 2026 audit traced a 2019 flaw that gave every CBP network user access to a powerful service account, plus offboarding that missed hundreds of leavers.

Tesla

Left a Kubernetes dashboard open with an over-privileged account

An administrative console was reachable without authentication, and the service account credentials behind it could do more than the workload needed.

tiny

Deleted its own Kubernetes operator and the standing service account

1,854 lines of controller code, six controllers and one pod went away, taking a service account that could read every secret in the namespace.

Microsoft

Decommissioned 1.4 million unused Entra applications

The Secure Future Initiative cut unused Entra applications, stripped critical-privilege Graph permissions and completed the Azure Service Manager retirement.

LastPass

Reached a storage bucket through a personal cloud account

Federated access from a personal cloud account linked to corporate resources carried attackers into a cloud storage bucket.

GitLab

Removed the OAuth password grant entirely

Client authentication was required from April 2025, then the Resource Owner Password Credentials grant was deleted rather than restricted.

Least Privilege