Account Access Review

Regular, structured, and systematic account access review is an imperative part of the identity and access provisioning life cycle.

These reviews are generally structured around groups of accounts, such as all systems administrators for a particular domain or business unit. These are planned reviews that should not be confused with the event-triggered reviews of an individual account described earlier.

Such reviews identify any discrepancies between roles and permissions of users, devices, processes, and systems. Another benefit of performing regular access reviews is identifying irregular activities that are permitted but require additional review.

There are other issues that can be identified in an account review, such as:

• Inactive accounts that have not been revoked:
• An employee is voluntarily or involuntarily terminated from an organization.
• An employee goes on extended leave and decides to leave the organization.
• User accounts with excessive permissions:
• When an employee changes positions, they get new permissions, but old permissions are not revoked, which is called permission aggregation.
• User accounts without permissions

Strange as it may sound, lacking permissions is also a security concern. If an individual needs certain permissions to perform his or her roles, but such permissions are not allocated, the users will find a way to do their job-sometimes using another user's credentials, effectively destroying our ability to use non-repudiation.

It is imperative that permissions access reviews are conducted on an ongoing basis so that any suspicious activities are identified in a timely manner.

Scheduled and regular permissions access reviews can reveal vulnerabilities that might require the need for revocation, disablement, or deletion of specific permissions or, in some cases, an entire account.

When discussing account review, it is vital to

As an example, let's look at a few of the include privileged accounts such as system security identifiers (SIDs) that are builtaccounts ("administrator," "sudo," or in user accounts on Microsoft Windows "root" accounts). These accounts are highly systems that can and should be obscured: desirable to attackers who are looking

• Administrator. A user account for the

for such accounts to elevate their ability system administrator. By default, it is the to perform action in the organizational only user account given full control over network. It is advised to avoid linking the system.

between the user ID name and its function since that increases the chances of the

• Default account. A built-in user-neutral

accounts being targeted. Thus, changing

account introduced in Windows 10 and the privileged account name is the first layer

Windows Server 2016 that can be used to of defense against attackers. Using "security run processes that are either multi-user

by obscurity" here requires more than just

aware or user-agnostic.

renaming a user or a system account; other attributes such as system-assigned static

• Guest. A user account for people who do numeric ID can also tip attackers as to the not have individual accounts and do not true purpose of an account, so changes require a password. By default, the guest must be made to these attributes as well. account is disabled.
• Domain administrators. A global group whose members are authorized to administer the domain. By default, the Chapter Admins group is a member of the Administrators group on all computers that have joined a domain, including the domain controllers. Domain administrators are the default owners of any object created by any group member.