Service Account Management

Service Account Management

Secure and govern service accounts that run critical IT systems

Challenge

Hundreds of thousands of services rely on privileged accounts to run critical IT processes, but they often aren’t understood and are tricky and time-consuming to govern.

Danger

Without oversight, service account passwords aren’t rotated, expiration dates pass or are never set, and accounts are never decommissioned, opening the door to cyber-attacks.

Solution

Automated privileged account governance prevents service account sprawl by managing service accounts’ lifecycle from provisioning through decommissioning.

What is a Service Account?

Service accounts are high-risk privileged accounts. They run scheduled tasks, batch jobs, application pools within IIS, and more across a complex network of databases, applications, and file systems. With outsourced IT operations, the proliferation of IoT, and the adoption of IaaS and PaaS platforms, understanding the landscape of services and the privileged accounts that run them is extremely challenging for IT and security teams. Service account management, therefore, has arisen as a top priority for many organizations.

What causes service account sprawl?

Service accounts aren’t tied to a unique human identity which decreases accountability and makes proper service account governance difficult, if not impossible. As a result, a system tied to a service account may no longer be needed, but the account may live on because no one is held responsible. Or, service accounts may have been set up for temporary purposes, like software installation or system maintenance, but left in place long after they are needed, often with default passwords.

The governance problem starts when services are set up. Centrally provisioning service accounts have been nearly impossible with existing technologies, so provisioning service accounts properly is time-consuming. Many organizations sidestep best practices. Default settings are often kept in place. Instead of creating unique accounts, credentials are often shared across multiple services in violation of least privilege and compliance policies.

Lack of service account governance violates security compliance requirements and increases the potential for cyber-attack. Without governance:

• You can’t ensure strong password strength across all accounts.
• You can’t control access to service account passwords.
• You can’t change passwords on service accounts without knowing the applications that are dependent on that credential for daily operation.
• You can’t maintain the required audit reports to prove compliance.

When security best practices aren’t followed for service accounts, former employees retain knowledge of privileged credentials and could use them to cause harm. When hackers gain access to service account privileges, they can disrupt not just one service but an entire network of business-critical systems.

Solutions for Service Account Governance

Traditionally, security and IT teams have attempted to manage service accounts manually. But, as organizations grow and accounts also manage cloud services, the number and access patterns of service accounts become overwhelming.

Identity Governance and Administration (IGA) tools help manage individuals’ passwords and privileged accounts but don’t provide management of non-human accounts such as service accounts. Integrations between PAM and IGA tools can’t solve the problem adequately as they are fundamentally focused on different types of accounts.

Enterprise password protection must also secure third-party access

Enterprise password protection goes beyond managing internal employee passwords. Contractors and partners may also need limited or temporary passwords, which you need to create, manage and remove when their lifespan is over. To keep tabs on third-party behavior in real-time, you may want to require an internal employee to authorize their access or even monitor and record sessions.

To solve the problem of service account sprawl, governance of service accounts has become a mandatory requirement for a comprehensive PAM solution.