| | June 2020ENTERPRISE SECURITY8IN MY OPINIONBeyond the Traditional User Accounts ManagementBy Arun Raghavendra, Head of IAM Technology, Visaraditionally, Identity and Access Management (IAM) involves managing Joiners, Movers, Leavers (JML) processes, user access reviews, standard user and privileged accounts management. Today, there are industry leading tools and standards that deal with these processes in small to large scale enterprises. These tools and standards are typically geared towards making these common IAM processes more efficient and user friendly. However, they do not always provide effective controls for the full spectrum of IAM use cases. When attackers want to penetrate a network, they often target and exploit accounts that are under-managed when compared to the more mature processes used to manage active user accounts. Without well-defined, mature management processes there is a greater risk of account compromise. Service accounts, orphan accounts, and dormant accounts pose significant risk if they are not managed securely and effectively throughout their lifecycle. Below are some best practices to keep in mind:Service accounts: A service account is a special type of account intended to represent a non-human user that needs to access other services/systems or data on an application or platform. Examples: software running on application servers will use a service account to access a Database via Java Database Connectivity (JDBC). The key characteristic of a service account is its persistence beyond the tenure of an individual employee within the organization, i.e. the service account needs to be continuously managed even after the person owning the service account leaves the organization. Service accounts are typically not deleted or disabled, unless no longer needed, and if they are not managed with care, then they may begin to impact production services. T· Managing the Service Accounts Lifecycle: Like user accounts, an effective service account lifecycle management process needs to be defined and implemented. Lifecycle management should include approval, creation, deletion and periodic reviews of service accounts. Since the service accounts are non-user accounts and cannot be easily tied to an identity, lifecycle management becomes more challenging. There are a few options to overcome these challenges, such as creating the service accounts in a separate Organizational Unit (in Active Directory, for example) or the assignment of an account attribute (such as type=service). A better way to detect a service account is at the origin and time of request, via a request portal. Once a request is approved, the details of the service accounts along with the owner information must be stored in a Configuration Management Database (CMDB.).Once service accounts are created in such a way that they can be distinguished from regular accounts, then these accounts should be read and represented in the IDM system. The representation in an IDM system can vary from linking the service accounts to an application owner, creating a standalone identity for each Service Account, or creating a persona identity for each User/Owner. For example, to manage serviceaccnt1_app1, serviceaccnt2_app1 etc., a persona identity (e.g.: "John_persona") is created in the IDM to represent the owner and all the service accounts are linked to this identity. Each of these options could have pros and cons depending on the complexity and the technical landscape of an organization. A suitable option should be chosen Arun Raghavendra
< Page 7 | Page 9 >