RE: Service Account Pswd Mgt

> -----Original Message-----
> From: kathy.kirk@prudential.com [mailto:kathy.kirk@prudential.com] 
> Sent: Thursday, January 05, 2006 4:50 PM
> To: security-management@securityfocus.com
> Subject: Service Account Pswd Mgt
>
> I've been asked how managing service accounts works in other 
> organizations.
> What is your policy for changing Service Account passwords? 
> Is it based on
> an event (e.g., administrator leaves the company) and or a 
> time requirement
> (e.g., every 90 days). If your organization does change 
> Service Account
> passwords, is it consistent across the organization? How do 
> you enforce
> your policy?
>
> By Service Account, I'm referring to system IDs used to 
> perform backups,
> automate FTPs, run applications, jobs, scripts, etc.
>
> thanks,
> kathy

Our policy for creating service account passwords is at least 12
randomly selected characters, requiring lowercase, uppercase, numbers,
and characters. We are a small company, and in general only system
administrators know service account passwords. Because of this, our
policy is to change them when someone who knows what they are leaves or
there is the possibility that one has been disclosed (however that may
be determined).

With service accounts there is really no reason why the password can't
be extremely strong, since regular users don't need to use them. Strong
passwords negate the need for frequent changing, unless they are passed
about or stored in clear text or something like that. And as always,
<generic disclaimer> your policy should reflect the amount of risk
involved in having that service compromised. </generic disclaimer>

Derick Anderson