Critical Control 11: Account Monitoring and Control

How do attackers exploit the lack of this control?

Attackers frequently discover and exploit legitimate but inactive user accounts to impersonate legitimate users, thereby making discovery of attacker behavior difficult for network watchers. Accounts of contractors and employees who have been terminated have often been misused in this way. Additionally, some malicious insiders or former employees have accessed accounts left behind in a system long after contract expiration, maintaining their access to an organization's computing system and sensitive data for unauthorized and sometimes malicious purposes.

How can this control be implemented, automated, and its effectiveness measured?

1. QW: Review all system accounts and disable any account that cannot be associated with a business process and business owner.
2. QW: Systems should automatically create a report on a daily basis that includes a list of locked out accounts, disabled accounts, accounts with passwords that exceed the maximum password age, and accounts with passwords that never expire. This list should be sent to the associated system administrator in a secure fashion.
3. QW: Organizations should establish and follow a process for revoking system access by disabling accounts immediately upon termination of an employee or contractor.
4. QW: Organizations should regularly monitor the use of all accounts, automatically logging off users after a standard period of inactivity.
5. QW: Organizations should monitor account usage to determine dormant accounts that have not been used for a given period, such as 30 days, notifying the user or user's manager of the dormancy. After a longer period, such as 60 days, the account should be disabled.
6. QW: On a periodic basis, such as quarterly or at least annually, organizations should require that managers match active employees and contractors with each account belonging to their managed staff. Security or system administrators should then disable accounts that are not assigned to active employees or contractors.
7. QW: When a dormant account is disabled, any files associated with that account should be encrypted and moved to a secure file server for analysis by security or management personnel.
8. Vis/Attrib: Organizations should monitor attempts to access deactivated accounts through audit logging.
9. Config/Hygiene: Organizations should profile each user's typical account usage by determining normal time-of-day access and access duration for each user. Daily reports should be generated that indicate users who have logged in during unusual hours or have exceeded their normal login duration by 150%.

Associated NIST SP 800-53 Rev 3 Priority 1 Controls:

AC-2 (e, f, g, h, j, 2, 3, 4, 5), AC-3

Procedures and tools for implementing this control:

A test account should be created every month, with very limited privileges so that it cannot access anything except public files on a system. No user should log into this test account. Any login activity to this test account should be investigated immediately. Automated software should check to ensure that the system generates a notice about such a test account after 30 days of non-use. Furthermore, an automated script should verify that the account has been disabled 60 days after the account was first created, notifying security personnel if the account has not been automatically disabled. At the end of this test interval, the first test account should be deleted, with a new limited test account created for the next round of automated checking.

List Of Controls

• Critical Control 1: Inventory of Authorized and Unauthorized Devices
• Critical Control 2: Inventory of Authorized and Unauthorized Software
• Critical Control 3: Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers
• Critical Control 4: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
• Critical Control 5: Boundary Defense
• Critical Control 6: Maintenance, Monitoring, and Analysis of Audit Logs
• Critical Control 7: Application Software Security
• Critical Control 8: Controlled Use of Administrative Privileges
• Critical Control 9: Controlled Access Based on Need to Know
• Critical Control 10: Continuous Vulnerability Assessment and Remediation
• Critical Control 11: Account Monitoring and Control
• Critical Control 12: Malware Defenses
• Critical Control 13: Limitation and Control of Network Ports, Protocols, and Services
• Critical Control 14: Wireless Device Control
• Critical Control 15: Data Loss Prevention

Additional Security Controls

The following sections identify additional controls that are important but that cannot be automatically or continuously monitored.

• Critical Control 16: Secure Network Engineering
• Critical Control 17: Penetration Tests and Red Team Exercises
• Critical Control 18: Incident Response Capability
• Critical Control 19: Data Recovery Capability
• Critical Control 20: Security Skills Assessment and Appropriate Training to Fill Gaps