ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™

Unmanaged Credential Storage

Authentication credentials, including passwords, API keys, and tokens are stored in unmanaged locations outside the scope of enterprise access governance. These may include plain text documents, spreadsheets, shared folders, configuration files, or personal notes. These storage locations are not subject to audit, version control, or policy enforcement, and often fall outside of privileged access management (PAM) or identity and access management (IAM) systems.

 

Unmanaged credential storage creates a latent security condition in which one or more subjects may be able to retrieve high-privilege credentials without generating any access logs or triggering control workflows. In many cases, these credentials are reused across systems, are not rotated, and are inconsistently protected. This creates durable risk, especially in environments where entitlement reviews do not include stored credentials as an exposure category.

 

The presence of unmanaged credentials increases the feasibility of lateral movement, privilege escalation, and untraceable access to sensitive systems. Investigators should treat the existence of untracked or insecurely stored credentials as an enabling factor when reconstructing access conditions for an infringement. Their presence also indicates control breakdowns that may permit future abuse or support behavioral drift within privileged roles.

Subsections (1)

ID Name Description
ME027.001Credentials in Ticketing Systems

Passwords, API keys, and privileged credentials are communicated, stored, or embedded in service desk tickets, including incident responses, change management notes, and administrative work orders. These credentials are often entered by IT or support personnel as part of access restoration, environment configuration, or user provisioning workflows.

 

Because many service desk platforms (such as ServiceNow, Jira Service Management, Freshservice & Zendesk) are broadly accessible across IT, engineering, and sometimes third-party vendor teams, the storage of credentials in ticketing systems significantly expands the number of individuals who can retrieve operationally sensitive access. In many cases, ticket logs are not considered part of the formal audit surface for access control, and standard retention, encryption, or obfuscation policies are inconsistently applied.

 

When credentials are available through searchable tickets, any subject with sufficient access to the service desk platform may bypass formal access provisioning and review processes. This creates an unmonitored path to privilege, especially when ticket histories are long-lived and tied to high-value systems. Investigators should treat such platforms as latent access repositories, especially during retrospective analysis of system access or in cases where no formal credential use appears in logs.