Text · page 4 of 15
Network Management How Should Officials Manage Network User Accounts? Network user accounts enable networks, computers and applications to recognize specific users, grant appropriate user permissions and provide user accountability by affiliating network user accounts with specific users. These accounts are potential entry points for attackers because, if compromised, they could be used to inappropriately access, and view data stored on the network. Therefore, network user accounts should be actively managed and periodically reviewed to minimize the risk of unauthorized access or misuse. Because generic network user accounts are not assigned to a single user, officials may have difficulty managing these accounts and linking any suspicious activity to a specific user. To help ensure individual accountability, all users should have and use their own user account to gain access to a network and applications. If generic network user accounts are needed (e.g., for certain network services or applications to run properly), officials should have procedures in place to monitor who uses the accounts and when they are used. A city should have written procedures for granting, modifying and revoking access rights to the network. To minimize the risk of unauthorized access, officials should regularly review enabled network user accounts to ensure they are still needed. Officials must disable unnecessary or unneeded network user accounts as soon as there is no longer a need for them, including network user accounts of former employees or employees who have transferred to another area. City Officials Did Not Adequately Manage Network User Accounts City officials did not actively manage network user accounts and the City did not have procedures in place for granting and revoking access rights to the network. We reviewed all 89 of the City’s enabled network user accounts and found 35 were assigned to current employees, 23 were generic network user accounts (not assigned to a specific user), 26 network user accounts were associated with former employees and five default network user accounts were administrative user accounts associated with specific software. Unneeded Generic Network User Accounts – Of the 23 generic network user accounts that we identified, nine were necessary for City operations and actively being used to perform various administrative functions. However, the remaining 14 generic network user accounts had not been used in at least six months, and three had elevated administrative permissions. The Specialist told us that these user accounts were unneeded and would be disabled and immediately removed the three user accounts with elevated administrative permission. City officials had not been reviewing and disabling unnecessary generic network user accounts. Unnecessary generic network user accounts expose the City to 2 Of f ic e of t he New York State Comptroller