7 deadly privileged accounts: discover → secure → manage.
Privileged accounts and privileged access are at the heart of every company's business today. They provide the IT team with the ability to administer and manage the organization's systems, infrastructure and software, and employees with access to the data that enables them to make key business decisions.
Privileged accounts are also the most common target of hackers and cybercriminals. They allow them to roam the network freely and undetected, gaining access to critical systems and sensitive data. Privileged accounts allow you to make changes to system and software configurations, perform administrative tasks, create and modify user accounts, install software, back up data, update security and patches, enable interactive logins and, of course, access sensitive data. All of these activities are critical to the operation of the company, keeping systems and software running.
Don't assume that privileged accounts are directly aligned with employee roles
Privileged accounts are usually limited to employee roles within a company, but can sometimes be mapped to user accounts regardless of their role. Therefore, assuming that privileged accounts are directly tailored to employee roles is a big mistake. Privileged accounts can be used by many different entities, for example: IT administrators, security teams, help desk staff, third-party contractors, application owners, database administrators, as well as operating systems and service accounts.
Privileged accounts can be found throughout an organization's infrastructure, regardless of their physical location - whether on premises, in the cloud or through SaaS applications. Typical locations for privileged accounts include default credentials on servers, endpoints
and operating systems. They can also be found in virtual environments, software, cloud environments, databases, service accounts and most applications. These are just a few examples. However, it shows that privileged accounts can be found virtually everywhere,
and the organization often has as many as five times as many systems.
Many organizations face the problem of cyber fatigue - a state of being overwhelmed by security responsibilities, i.e. the huge number of passwords and credentials that employees must maintain and remember. This is a serious problem throughout the company and affects not only the IT team, but also the security team and all employees who need access to multiple systems and applications.
Failure to update privileged account balances has resulted in financial losses for many organizations
In addition to cyber fatigue, companies face the challenge of maintaining privileged access on an ongoing basis, especially when employees' roles change or when they leave the organization. Breaches and abuse of privileged accounts have already exposed many organizations to huge losses. Securing service accounts is also a challenge, as they have historically been configured with static passwords that do not expire and never change.
In response to these challenges, we present "7 Deadly Privileged Accounts" that all organizations should discover, properly secure and manage to reduce the security risks of their operations.
- King of all accounts: "Domain administrator account".
An account from which you can do almost anything. The domain administrator account has full access and control over the AD domain. This group is by default a member of the Administrators group on all domain controllers, all domain workstations and all member servers when they join the domain. By default, the administrator account is a member of this group. Since the group has full control in the domain, always add users with special care, full auditing and authentication. [1]
These accounts should be as restricted as possible: access and use of these accounts must be granted only on a request basis with additional credentials to prevent unauthorized use. All their activities should be fully controlled and monitored.
- Difficult and scary "Domain service accounts".
These accounts connect multiple systems and applications so they can communicate and access the resources they need, typically to run reports, access databases or call APIs. These accounts seem to be problematic, especially when changing passwords, which in almost all situations causes the application to break until it is synchronized in the environment. These difficult and scary moments are due to the "don't touch that password" rule adopted in organizations or the detailed processes for handling them. These accounts are typically used for backups, analytics solutions, software deployment and security patch updates.
- Forgotten "Local administrator account"
Sometimes called the "forgotten privileged account," that is, the one to which many companies grant access to all employees. It is the one that all cybercriminals target to assess an organization's security and protection level. This is the main culprit of overly privileged employee accounts.
The default local administrator account is the user account for the system administrator. Each computer has an administrator account (SID S-1-5-domain-500, display name: Administrator), and it is the first account created during installation for all Windows Server and Windows Client operating systems.
On Windows Server operating systems, the Administrator account gives the user full access to files, directories, services and other resources under the control of the local server. The Administrator account can be used to create local users, assign user rights and access control permissions. The Administrator account can also be used to take control of local resources at any time by simply changing user rights and permissions.
The default administrator account cannot be deleted or disabled, but it can be changed or deactivated. [2]
- Helpful "Emergency Accounts"
These accounts are usually disabled by default until a critical incident occurs. After it occurs, specific users must have privileged access to restore systems, services or even respond to security incidents. They are only used in emergency situations when normal services are not available. For example, during a cybercrime incident, they are used to access systems for digital expertise and reduce contamination of log evidence. They can also be used to curb the continued abuse of compromised accounts.
- Hidden and eternal "Service Accounts"
Service accounts are typically used in operating systems to run applications or programs, either in the context of system accounts (high-privilege accounts without passwords) or a specific user account (usually created manually or during software installation). On Unix and Linux systems, they are often known as 'init' or 'inetd' and can also run programs. Service accounts usually cannot log on to systems, but are most often protected by a never-changed password. Moreover, these accounts do not expire. Service accounts are often abused by cybercriminals, who break them and run their own binaries on elevated privileges that give them remote access.
- Enhanced "Application Accounts"
Application accounts are routinely used to provide applications with access to required resources, such as databases, networks, automated tasks (e.g., software deployment), automatic updates and the ability to make configuration changes. These accounts typically store passwords in configuration files, sometimes using local or service accounts for necessary access. Application accounts are also a common target for cybercriminals, as they can be easily breached using known vulnerabilities that allow attackers to gain remote access, modify system binaries or elevate standard accounts to privileged ones, allowing them to roam the network. Most organizations can't properly "patch" applications, so attackers can abuse these vulnerabilities all too often.
- Inconspicuous but deadly, "Privileged Data User Accounts."
This is probably the most dangerous privileged access of all. Yes, this account is a standard user account, but it has ACCESS to VULNERABLE, PRIVATE DATA. Think of a doctor who has access to patient data or an accountant who has access to financial statements. These are normal user accounts, but it's all about what they have access to. Privileged data user accounts are often not monitored or secured like privileged accounts, and security focuses on the application where the data is stored, though not always. Companies should conduct data risk assessments to detect privileged data and secure ALL standard accounts that have access to sensitive data.
These are just some of the privileged accounts that organizations should prioritize securing to reduce the risk of breaches and abuse.
Other privileged accounts include:
- Root accounts
- Accounts used to access security solutions
- Wi-Fi accounts
- Hardware accounts, such as BIOS and vPro
- Privileged user accounts
- Network equipment
- Firewall accounts
- Shared privileged accounts
Want to learn more about securing privileged accounts? Get in touch with us!
Source: https://thycotic.com/company/blog/2019/03/26/top-7-deadly-privileged-accounts/?utm_medium=Organic-Social&utm_source=linkedin&utm_campaign=7-deadly-privileged-acccounts&utm_content=32519&utm_term=32519_7-deadly-privileged-acccounts