Skip to main content

Pro audit program · v1.0

Service Account Hygiene

Service accounts get over-privileged and never rotated — quick health check on inventory, scoping and credential rotation.

  • General target area
  • NIST CSF framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Service accounts get over-privileged and never rotated — quick health check on inventory, scoping and credential rotation.

Risks addressed

  • Critical Over-privileged service account abused for lateral movement
  • High Stale service accounts not deprovisioned when systems retire
  • Critical Service account credentials hardcoded in scripts / repos

Controls (6)

  1. Inventory of all service accounts

    High

    Inventory of all service accounts

    How to test + evidence

    Testing procedure: Request the service-account register; reconcile with IdP groups and CMDB.

    Evidence to collect: Service-account inventory CSV.

  2. Least-privilege scoping for each service account

    Critical

    Least-privilege scoping for each service account

    How to test + evidence

    Testing procedure: Sample 5 accounts; verify each has only the rights it actually needs.

    Evidence to collect: Role assignment dump.

  3. Credentials vaulted (no hardcoded secrets)

    Critical

    Credentials vaulted (no hardcoded secrets)

    How to test + evidence

    Testing procedure: Search repositories + config stores for service-account secrets. Confirm PAM coverage.

    Evidence to collect: Secret-scan report + PAM coverage.

  4. Automatic rotation enabled

    High

    Automatic rotation enabled

    How to test + evidence

    Testing procedure: Verify passwords / keys rotate on a documented cadence.

    Evidence to collect: PAM rotation log.

  5. No interactive logon to service accounts

    High

    No interactive logon to service accounts

    How to test + evidence

    Testing procedure: GPO / IdP policy blocks interactive logon for service accounts.

    Evidence to collect: Policy export.

  6. Disable / decommission stale accounts

    Medium

    Disable / decommission stale accounts

    How to test + evidence

    Testing procedure: Accounts inactive for >90 days are flagged and disabled.

    Evidence to collect: Inactivity report.