The Principal of Least Privilege suggests that network services should not run with powerful and unnecessary capabilities. History teaches us that this is painfully necessary; 25 years ago Sendmail and BIND ran as root, and shifted to run as non-privileged users to limit the damage demonstrated by numerous buffer overflows and other attacks. Alternative mail servers like Postfix and qmail were foundationally designed to run as non-root users, and the user context of Apache was an item on every checklist I've ever seen to secure Apache.
However, running a service as root is not a vulnerability per se; to quote OWASP,
The failure to drop system privileges when it is reasonable to do so is not a vulnerability by itself. It does, however, serve to significantly increase the Severity of other vulnerabilities.
So, for example, there's no OWASP Top Ten saying "Don't run services as root." Just other issues (like 2004-A5 "Buffer Overflows") whose impact is made more severe if the service is run as root.
Which makes it difficult to convince non-Security personnel that this is a Bad Thing.
So my question:
Can you point me to any cite-able references from reputable authorities that can be used to impress upon non-Security personnel (e.g. developers, IT, management) the importance of not running services with root privileges?