Orphan Accounts Cleaning
best practice
Summary
Attackers create new or reuse existing accounts. Orphan accounts are a preferred target because their compromise is stealthier. Orphan accounts augment the attack surface without necessity. Having a strong process that prevents, detects, deactivates, and deletes orphan accounts through systematic account correlation mitigates this risk.
CMM Level 1: Initial
The identification and cleaning of orphan accounts is ad hoc. Accountability for the process is not clearly established and resources are not provided by the organization. The presence of orphan accounts is largely unknown.
CMM Level 2: Repeatable
The organization provides resources for the process. Correlation of accounts is performed but its scope is not clearly defined. Some orphan accounts are regularly identified and remediated.
CMM Level 3: Defined
Procedures define requirements applicable to the prevention, identification and remediation of orphan accounts.
Roles and responsibilities for this process are clearly established. Typical actors include IT owners, business owners, system administrators, provisioning teams, and information security.
The scope and methods used for account correlation are clearly defined. If portions of the information system are not covered by the process or infrequently covered, this is documented and related risks are accepted.
Account naming conventions are authorized, documented, and maintained.
Accounts non-compliant with the authorized naming conventions are remediated.
Golden sources for identity correlation are defined.
CMM Level 4: Quantitatively Managed
The discovery and correlation of accounts is preferably automated when technically feasible. When technically unfeasible, the discovery and correlation of accounts is performed manually.
The presence of uncorrelated accounts is quantified.
The coverage of the correlation process is quantified.
The delay between uncorrelated account identification and remediation is quantified.
CMM Level 5: Optimizing
Independant audits review both the presence of orphan accounts and the overall process.
The root causes of the presence of orphan accounts in the information system are analyzed and used to further prevent their occurence.
See Also
Related Best Practices
Bibliography
Quotes are only visible to subscribed members.
Filter by label
There are no items with the selected labels at this time.
Follow us on LinkedIn | Discuss on Slack | Support us with Patreon | Sign-up for a free membership.
This wiki is owned by Open Measure, a non-profit association. The original content we publish is licensed under a Creative Commons Attribution 4.0 International License.