Shared Account Abuse
Shared account abuse begins wherever several people use the same username and password. The system then no longer knows who actually did something. It knows only that a particular account was used, which for accountability is the same as knowing nothing.
Term
description · examples · notesShared account abuse begins wherever several people use the same username and password. The system then no longer knows who actually did something. It knows only that a particular account was used, which for accountability is the same as knowing nothing.
Description
Shared accounts are usually justified by practice: a team admin account, a generic service account, a shift account, a database account, an account left over from an old application. Over time the password circulates through messages, documents and the memories of people who are no longer on the team.
When an incident comes, the problem is not only access. The problem is attribution. It cannot be said with any confidence who logged in, who changed the setting, who exported the data, or who passed the password on. A shared account erases the trail before the incident even starts.
Examples
- The whole IT team uses the same administrator account to manage the servers.
- A service account with broad rights is used by several applications and its password has not changed in years.
- A shift account in an operations center is used by everyone, so it is not known who made a critical change.
Notes
- A shared account is an organizational shortcut that later makes any forensics impossible.
- If an account has to be shared because of a technical limitation, the access belongs behind PAM, session recording and credentials issued for a limited time.
Techniques
carried out with 3Techniques used to carry it out. Select one to open its page.
Defenses
countered by 5How it is defended against. Select one to open its page.