I have some users that prefer to create a new user account instead of resetting the password (or investigating why there is an issue with the account). Then delete the old account.

I've personally found that this is generally bad practice for an admin and a suspicious pattern from a security point of view (user SID change, so we may lose user traceability).

Do you think this is a real security concern?

  • 1
    Do you mean the admins just create new accounts for themselves? If so ..... wooooow. – schroeder Aug 5 '19 at 11:55
  • @schroeder : It is correct, they deleted the old account and recreate it just after. – user213795 Aug 6 '19 at 6:52

The practice is always that all accounts must be approved by the system owner, not the admin. That means that any new account needs justification, definition, visibility, and is audited regularly to determine that the account is still valid.

Creating tons of user accounts and not disabling/deleting them is a massive problem. Each one can be exposed and because there is on one monitoring them, they can do anything.

Traceability is not a major concern, there will just be a lot of SIDs to track for the same user if you need to correlate activity.

My bigger concern is that this indicates a lot of other issues around administration that would likely need to be addressed.

| improve this answer | |
  • Hi. Thanks for your answer ! I've missed the IAM and life cycle management point, good ! For traçability, i'm loosing the creation date of the object, could be a concern. – user213795 Aug 6 '19 at 6:53
  • If the issue is that there is just that the admins work with all these new accounts for themselves, I'm not really sure that there is a big impact. Yes, you lose the investigation opportunity and the attribution gets more complicated, but I'm not sure there is a big security problem. Procedurally, there is the bigger issue. – schroeder Aug 6 '19 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy