Slide 24 · MIT 06
Minimum-privilege third-party integrations — limit what a compromised vendor can affect.
If the third-party is breached, what can they do with the access you gave them?
The principle
Every third-party integration should be scoped to the minimum access required for its function. Excess permissions — granted for convenience or “just in case” — expand the blast radius of a vendor compromise. Minimum-privilege doesn’t prevent the compromise; it limits what the attacker can do with the compromised integration.
🔑
Scope OAuth tokens to minimum required permissions
When integrating via OAuth, request only the scopes your integration needs. Don’t request write:all if your integration only needs read:profile. A compromised OAuth token with read:profile scope can only read profile data. The same token with write:all can modify data, delete resources, and exfiltrate everything accessible to that scope.
🖪️
Use separate API keys per integration
Don’t share a single API key across multiple third-party integrations. Separate keys allow: precise revocation (revoke only the affected key when a vendor is breached), per-integration rate limiting and logging, and minimal-scope issuance (each key carries only the permissions its integration needs). Key rotation is also easier when integrations are independently keyed.
🚨
Monitor third-party API usage for anomalies
Log all third-party API calls: endpoint, response code, response time, response size. Alert on anomalous patterns: sudden increases in response size (data exfiltration in responses), new fields appearing in responses (schema change — possible injection), or unexpected redirects. A compromised CDN script or API will exhibit behavioral changes that deviate from the baseline — but only if you’ve established a baseline.
💼 Business takeaway
Ask your team to list what permissions each third-party integration currently has. If a chatbot widget, analytics tool, or support system has write access to your database or customer data, ask why — and reduce it to the minimum required for the integration to function.