NIST-AC-2 Account Management

a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [Assignment: prerequisites and criteria] for group and role membership; d. Specify: 1. Authorized users of the system; 2. Group and role membership; and 3. Access authorizations (i.e., privileges) and [Assignment: attributes (as required)] for each account; e. Require approvals by [Assignment: personnel or roles] for requests to create accounts; f. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; g. Monitor the use of accounts; h. Notify account managers and [Assignment: personnel or roles] within: 1. [Assignment: time period] when accounts are no longer required; 2. [Assignment: time period] when users are terminated or transferred; and 3. [Assignment: time period] when system usage or need-to-know changes for an individual; i. Authorize access to the system based on: 1. A valid access authorization; 2. Intended system usage; and 3. [Assignment: attributes (as required)]; j. Review accounts for compliance with account management requirements [Assignment: frequency]; k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and l. Align account management processes with personnel termination and transfer processes.

Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts. Where access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission/business requirements. Failure to consider these factors could affect system availability. Temporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared/group, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared/group authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training.

• T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1005 Data from Local System • T1020.001 Traffic Duplication • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.005 VNC • T1021.006 Windows Remote Management • T1021.007 Cloud Services • T1021.008 Direct Cloud VM Connections • T1025 Data from Removable Media • T1036 Masquerading • T1036.003 Rename System Utilities • T1036.005 Match Legitimate Name or Location • T1036.010 Masquerade Account Name • T1041 Exfiltration Over C2 Channel • T1047 Windows Management Instrumentation • T1048 Exfiltration Over Alternative Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1053 Scheduled Task/Job • T1053.002 At • T1053.003 Cron • T1053.005 Scheduled Task • T1053.006 Systemd Timers • T1053.007 Container Orchestration Job • T1055 Process Injection • T1055.008 Ptrace System Calls • T1056.003 Web Portal Capture • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.002 AppleScript • T1059.003 Windows Command Shell • T1059.004 Unix Shell • T1059.005 Visual Basic • T1059.006 Python • T1059.007 JavaScript • T1059.008 Network Device CLI • T1059.009 Cloud API • T1059.010 AutoHotKey & AutoIT • T1059.011 Lua • T1068 Exploitation for Privilege Escalation • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.003 Clear Command History • T1070.007 Clear Network Connection History and Configurations • T1070.008 Clear Mailbox Data • T1070.009 Clear Persistence • T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.001 Default Accounts • T1078.002 Domain Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1087 Account Discovery • T1087.004 Cloud Account • T1098 Account Manipulation • T1098.001 Additional Cloud Credentials • T1098.002 Additional Email Delegate Permissions • T1098.003 Additional Cloud Roles • T1098.005 Device Registration • T1098.006 Additional Container Cluster Roles • T1098.007 Additional Local or Domain Groups • T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1134 Access Token Manipulation • T1134.001 Token Impersonation/Theft • T1134.002 Create Process with Token • T1134.003 Make and Impersonate Token • T1136 Create Account • T1136.001 Local Account • T1136.002 Domain Account • T1136.003 Cloud Account • T1185 Browser Session Hijacking • T1190 Exploit Public-Facing Application • T1195 Supply Chain Compromise • T1197 BITS Jobs • T1210 Exploitation of Remote Services • T1212 Exploitation for Credential Access • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.003 Code Repositories • T1213.004 Customer Relationship Management Software • T1213.005 Messaging Applications • T1218 System Binary Proxy Execution • T1218.007 Msiexec • T1218.015 Electron Applications • T1222 File and Directory Permissions Modification • T1222.001 Windows File and Directory Permissions Modification • T1222.002 Linux and Mac File and Directory Permissions Modification • T1484 Domain or Tenant Policy Modification • T1485.001 Lifecycle-Triggered Deletion • T1489 Service Stop • T1490 Inhibit System Recovery • T1495 Firmware Corruption • T1505 Server Software Component • T1505.002 Transport Agent • T1505.003 Web Shell • T1505.005 Terminal Services DLL • T1525 Implant Internal Image • T1528 Steal Application Access Token • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1538 Cloud Service Dashboard • T1542 Pre-OS Boot • T1542.001 System Firmware • T1542.003 Bootkit • T1542.005 TFTP Boot • T1543 Create or Modify System Process • T1543.001 Launch Agent • T1543.002 Systemd Service • T1543.003 Windows Service • T1543.004 Launch Daemon • T1543.005 Container Service • T1546 Event Triggered Execution • T1546.003 Windows Management Instrumentation Event Subscription • T1547.004 Winlogon Helper DLL • T1547.006 Kernel Modules and Extensions • T1547.009 Shortcut Modification • T1547.012 Print Processors • T1547.013 XDG Autostart Entries • T1548 Abuse Elevation Control Mechanism • T1548.002 Bypass User Account Control • T1548.003 Sudo and Sudo Caching • T1548.005 Temporary Elevated Cloud Access • T1548.006 TCC Manipulation • T1550 Use Alternate Authentication Material • T1550.002 Pass the Hash • T1550.003 Pass the Ticket • T1552 Unsecured Credentials • T1552.001 Credentials In Files • T1552.002 Credentials in Registry • T1552.004 Private Keys … and 70 more