.png)
There are several factors to consider when planning and implementing a service account password rotation.
Concerns:
Is the account used in a critical function that can’t be broken?
Does anyone know the account password?
Is the account used within an application?
Are multiple teams responsible for one account?
Who installed the application?
When companies start talking about service account management and the above concerns go unanswered, usually it is decided that it is less risky to leave the password as is and never change the password.
There are a few different ways to rotate service account passwords, but one of the most effective is to use a password management tool. This will allow you to automatically generate and rotate passwords for all your service accounts on a schedule that you define. The below references using a Privileged Access Management (PAM) tool.
Approach PAM Incrementally
Phase 1 – Vaulting
o Prepare a non-managed space folder structure.
o Vault from the discovery report all service accounts to secrets in the non-managed folder.
o Vault all dependencies to the secrets.
o This will allow visual for investigation of all the places the account is being used.
Phase 2 – Preparation for Managing
o Start investigating the accounts in the Vaulting Hold folder.
o Meet with teams that are responsible for each application.
o Determine, stage, test, or production account.
o Determine critical and non-critical accounts.
o Determine usage of account.
o Ask additional finding questions.
Phase 3 – Managing Service Accounts
o Start with stage and test accounts
o Plan for the password rotation.
o Test the change in the environment.
o Did the password update successfully?
o Does the application still work?
o Set a schedule for frequent automatic password rotation.
Once you have successfully changed the password in your stage or test environment, identified any additional processes that need to be updated, you can move on to the production account without concern of breaking the application.
o Non-critical accounts
o Same process as above.
o Critical accounts
o Investigate any special requirements from the application before password change.
o Same process as above.
Password rotation doesn’t have to be overwhelming.
– Don’t panic: Utilize a PAM tool with the Discovery feature
– Remain calm: Follow the processes above
Conquer your accounts successfully today!
Have question or comment? Feel free to post below or send to info@identityandaccesssolutions.com.
Comments