Account Management

Why Is This Control Critical?

It is easier for an external or internal threat actor to gain unauthorized access to enterprise assets or data through using valid user credentials than through 'hacking' the environment. There are many ways to covertly obtain access to user accounts, including: weak passwords, accounts still valid after a user leaves the enterprise, dormant or lingering test accounts, shared accounts that have not been changed in months or years, service accounts embedded in applications for scripts, a user having the same password as one they use for an online account that has been compromised (in a public breach), social engineering a user to give their password, or using brute force to guess a password. Administrative, or highly privileged, accounts are a particular target, because they allow attackers to add accounts, change configurations, read and modify stored data, impersonate regular users, and conduct data theft.