Service accounts

A service account is an account that an application, a scheduled task or a script uses to authenticate, rather than a human being. Backup, antivirus, database, monitoring tool: each one runs under its own. These accounts pile up flaws that a named user account rarely combines. Their rights are broad, because at install time the goal was to make it work. Their password never changes, because changing it can take production down. And MFA (multi-factor authentication) does not apply, since nobody is there to approve the prompt. In Active Directory the textbook attack is Kerberoasting. Any domain user can request a ticket for a registered service; that ticket is encrypted with the service account's password, which the attacker then cracks offline without making any noise on the network. A short password set ten years ago falls fast. September 2022, Uber: the intruder, in through MFA fatigue on a contractor's account, says he found on a network share a PowerShell script holding plaintext admin credentials for the privileged access management tool. January 2024: Microsoft explained that Midnight Blizzard had used an old test OAuth application with elevated permissions to read mailboxes belonging to its senior leadership. The questionnaire asks for an inventory of service accounts, how many sit in domain admin groups, how their passwords rotate and whether group Managed Service Accounts (gMSA) are used, whose secret the domain changes on its own. Ransomware supplements often place these questions next to the ones on privileged access management. The honest answer is frequently "we don't know how many". A seasoned underwriter would rather see that admitted unknown than a round zero.