Almost 50% of data breaches are a result of stolen credentials. This is why it is critical to secure all cloud service accounts. Cloud service account security is often overlooked and this can be a leading cause for security vulnerabilities.
Cloud services provide higher access between software and processes most of which are automated. Configuring these accounts and removing the default passwords or log-in credentials is critical. Having strong password policies for cloud services is also a crucial practice.
Most companies practice poor cloud password practices like password sharing or even password re-use which creates a single point of failure. In case of a data breach and passwords for these services are compromised, the attackers can get access to other high-level IT systems.
A cloud service account should be properly secured. Users and IT personnel should not just configure the basic needed things and walk away. Cloud service infrastructure requires advanced management. This will make the services flexible and reduce overall risks targeting the cloud system and infrastructure.
Service accounts are used to run automated services and execute applications alongside other processes. Cloud service accounts may at times have higher administrative privileges which facilitate smoother IT operations. This higher-level access and privileges may at times be difficult to manage.
Challenges In Managing and Securing Cloud Service Accounts
For business continuity and proper functioning, underlying systems and services have to be properly configured and functional. Any compromise of underlying critical functions like cloud services may lead to widespread system outages especially if the affected accounts are associated with other critical services.
Some of the challenges that businesses should look out for in managing cloud services include:
1.Administration challenges.
Many cloud service accounts are not directly associated with human access and identity verification. This makes them require credential sharing which leads to a lack of accountability which can then make management difficult.
Cloud service accounts and some of their features may run for longer than it is required since nobody is allocated to them directly. Some other services which are related to software updates and maintenance may be left for long with risky default passwords.
A business may be running Linux, Unix, Windows, and cloud service accounts which makes centralised provisioning difficult. User accounts and administrator account are all different. Due to management challenges, most companies often resolve to manual provision and management of the service accounts. Manual management of critical service accounts is often associated with errors and the process can also be strenuous and worse of all disastrous.
An unmastered credential change can lead to disruption of services which may make critical services go down. In terms of passwords, the users may opt for short and easy-to-remember passwords and in some cases even password re-use for multiple service accounts. Accounts that share the same password can be compromised easily.
2. Access challenges
Cloud service accounts often have higher privileges on the local system and in some systems like windows, domain accounts access to some off-system resources. Service accounts hardly require Domain Admin account level privileges but in some systems, they are over-privileged. This may be an unforeseen danger that can impact service and business continuity.
3. Password challenges
For a service account, any password change for a superuser account or credential means that it must also be performed in the active directory and every other application or service that stores the password for the same service or credential. All links to the active directory must also be updated, which means propagation. Using incorrect passwords could lead to the users being locked out of their user account by the operating systems since it thinks it is under attack. Easy passwords can easily expose sensitive data.
4. Auditing challenges
Cloud service accounts create visibility issues among non-human accounts since many run in the background. This makes them avoid oversight and scrutiny from the domain administrator account. This is why such accounts are sought after by attackers. It may be difficult to audit them also since they may have multiple users or identities which makes it difficult to log a single user’s actions to the cloud service account.
Managing Cloud Service Accounts Securely and Best Practices to Follow
1. Always automate the onboarding and the management of new accounts
Automating the user account classification and profiling process will ensure that all new cloud service accounts are under active directory users which will remove the difficulties of manual management and administration. With this, the domain admins group will have visibility privileges overall accounts.
The local administrator account should always monitor access and secure cloud service account. Credentials like SSH keys and passwords to cloud service accounts should be centrally secured in an encrypted credential storage like a safe. In addition, there should be continuous and controlled access to the service account’s credentials to mitigate the risk of misuse by threat factors.
If passwords or credentials to secure service accounts are changed, the process of generating new ones should be automated to prevent system downtime and failure. Businesses should rely on a proper managed service accounts tool to store and generate a proper and secure service account password.
2. Applying the principle of least privilege
When a user wants to create service accounts, they should avoid putting service accounts with privileges they won’t need. Such include remote control rights. The privileged groups with access to the domain admin service account should also be limited.
Businesses should have a plan for service accounts in case of any disaster, network outage, or interruption. Businesses should also avoid putting cloud service accounts in built-in privileged groups like domain admins groups to ensure confidentiality of service account credentials.
3. Ensuring all cloud service accounts are under a centralised management
If the user of the administrator account does not know where all the privileged cloud service accounts are, they will not be able to fully be in control or audit the operations of the system and the users. There should be a method for continuous identification and listing out all processes for easier central management.
This can be done through a tool that will discover all locations in the network where any cloud service account is referenced. Upon identification of all the services and accounts, they should be brought under the centralised management. This will ensure easy management and proper risk mitigation strategies.
Attackers are now leveraging cloud service accounts vulnerabilities to exploit businesses. Many companies don’t practice proper and secure management to cloud service accounts. This can be either leaving default credentials for long, storing cloud service accounts in privileged groups like the domain admin group, or other unhealthy practices.
Companies should rely on security tools and security professionals like Kaesim Cybersecurity to configure their cloud service accounts and ensure they run smoothly and securely.
How cyber-secure is your business? Find out with our free cybersecurity health check.
It’s a 30-minute Zoom call that walks through a checklist to assess your current cybersecurity levels and provide a short report with some advice and recommendations.
