There are a lot of questions on the exam that talk about how we deal with user accounts.
Now as you can imagine user accounts are a big issue when it comes to security in general.
But in this episode I just want to kind of enumerate a number of really really important issues that
you're going to see on the exam.
So we need to take this a little bit bigger than for example well I know I'm going to be setting up
users and groups so I know things like for example Microsoft best practices users go into groups who
gets rights and permissions.
I mean we you should know that.
But what I want to do is break this down and enumerate it a little bit more tightly to tie into what
you're going to see on the exam.
So let's start off with number one continuous monitoring
your number one best buddy when it comes to user account issues is continuous access monitoring.
You should be monitoring 24/7 what your users are getting into to be able to have an idea of what's
going on within your infrastructure.
So that could be hundreds of different things under hundreds of different types of applications.
But in general and for the exam Remember it's always good to track when people are logging in or logging
off to a particular resource and also keeping very close track of file access.
In particular if you have large database files or if you have personnel files something that's really
really important and you want to know what people are doing continuous monitoring of that file access
can really help you if you run into trouble in the future.
OK the next one I want to talk about is a big problem and that's shared accounts.
The bottom line is is that shared accounts are a bad thing.
If I see people using shared accounts it usually just shows that they're being lazy in terms of doing
good security.
Probably one of the worst examples and everybody everybody's guilty of this.
Are these home networks where you're set up as a work group and each individual system has the same
user and everybody just logs in whatever they want to log into.
Well maybe for your house that's OK.
But in an enterprise environment that is utterly utterly unacceptable.
The bottom line is is that continuous user access monitoring is going to be the tool that helps us watch
out for that type of stuff.
I guess about the only excuse I would ever see for shared accounts is you have some weird resource like
a old print or something that could only have one account and even that's pretty much rare.
So bottom line is don't do shared accounts.
So go into the opposite of that.
Now let's talk about multiple accounts
multiple accounts sometimes just has to happen.
Shared accounts is a sign of being a bad security person.
Multiple accounts sometimes just has to happen.
So let's talk about those types of scenarios.
Number one if you're going to be using multiple accounts use different usernames and passwords.
Now what we're talking about here is where you've got a Windows domain log in with one user name and
password and you use that same username and password to get into your e-mail server or whatever it might
be.
That's a bad idea if you're going to be using multiple accounts for one person like this.
Always try to use different usernames and passwords.
While we're at it always use different groups.
So if you are let's just stick with Windows so you're logging into a domain and you have two or three
different groups for one reason or another.
Make sure that those users are in different groups when they log in if they're all in the same group
or if even a few are in the same group.
That's often a good sign that you're not doing good security.
The third big issue is that in a lot of situations we will give people who would ordinarily not have
really high privileges.
Sometimes we give them very very high privileges.
So a great example is I got this guy in my accounting department who they print like crazy I mean they're
always printing.
So I need somebody down in the accounting department who can clear the print queue or do whatever they
need to do his regular account doesn't have those permissions.
So what I did is I gave him a special account that he can log in with and just do whatever he needs
to do at that local accounting printer.
The important thing here is that if you give someone a second account with elevated privileges make
sure they understand they will go ahead and log in with the elevated privileges only to do what they
need to do and then log off.
So if he's got a problem on the printer he logs off with his regular account logs in with his privilege
account does what needs do with the printer and then gets off.
It's very very easy for people to just try to stay and do their normal work with an elevated privilege
account.
And that's a big no no.
OK.
The fourth thing and this is a big one is when you're in a scenario where you have a lot of multiple
accounts log everything you really want to keep close track on multiple account scenarios to make sure
people are doing the right thing.
OK.
So the last one I want to talk about is probably the biggest issue of all when it comes to user account
issues and that's default and generic user names.
Your networks are filled with generic and default usernames.
I mean at the very top of it is you've always got like your admin account or your supervisor account
or whatever it might be for logging in to a router or to your domain control or whatever it might be.
If you've got databases a lot of them have D-B admin is their default account to log in with if you
have these types of accounts what you want to do is not use those.
If you can disable then great if you can delete them great what you want to do instead is always use
dedicated service accounts.
That way you'll always know who's logging into what if you have somebody who needs elevated privileges
to do something crazy at the top of all your routers and you create a router you Mike's router account
or something like that that makes it easy to log easy to understand and easy to track to see what people
are doing.
So we've gone through a number of very specific user account issues you're going to be seeing all these
on the exam.
Take a minute.
Memorize them all.