What are Dormant Accounts

Dormant Accounts are user accounts that exist within an organization's IT systems and applications and are still considered "active" and "enabled," but have had no "activity" (e.g., logins, resource access, etc.) for an extended period of time. Unlike orphaned accounts where the user has lost his/her legitimate owner, dormant accounts do still have an owner; they're just not using it. These accounts also represent a "forgotten" or "underutilized" digital identity.

For instance, imagine a spare key to your house that you stashed away in a dusty drawer years ago – you know it is there, but you have completely forgotten about it, and anyone who found that key could walk right in.

How Dormant Accounts Arise:

• Lapsed use: User accounts created to support external auditors, seasonal contractors, or emergency access that have been used periodically, and simply forgotten.

• Role changes without access changes: Employee switches departments and no longer uses applications from previous department, but access and permissions are not completely removed (privilege creep).

• Application Migration: New application replaces older application, but user accounts in older system, remain enabled.

• Shadow IT/Departmental Accounts: User accounts initiated for specific department purposes that fall out of use (non-official) but not deprovisioned by central IT.

• Test/Development: User accounts created for testing purposes, but remain enabled after testing is complete.

The Threat of Dormant Accounts

Dormant accounts are a major risk, albeit not as serious as orphaned accounts. Dormant accounts represent a security weakness that could develop into a significant compromise because dormant accounts are enabled accounts that tend to be ignored. Dormant accounts typically do not appear on a security audit or monitoring. While enabled, they may seem promising if attackers can successfully create a lack of awareness and attention.

Here are the primary reasons why dormant accounts are dangerous:

• Stealth: A compromised dormant account may provide an unobstructed attack to the attacker. Most of the time, no legitimate activity comes from them, which means any malicious activity present on the account may go by unnoticed, and the attacker quietly continues to develop an persona for an extended period.

• Weak Passwords: Dormant accounts are traditionally default created passwords or simplified credentials that owners may have never changed. These dormant accounts are easily susceptible to brute-force attacks. Dormant accounts rarely take advantage of current security, such as Multi-Factor Authentication (MFA).

• Privilege Creep: A dormant account may have had multiple privileges assigned over time. This changes based on sometimes changing roles and adding directors to specific projects. Once compromised, a dormant account may enable lateral movement which violates the Least Privilege Access principle.

• Complimentary violation: Regulatory frameworks require organizations, at a minimum, to keep an accurate record of active users, including what they can access or conduct. Breaking compliance with dormant accounts can carry serious consequences. In the realm of access transparency and auditability, dormant accounts may have considerable impacts on GDPR, HIPPA, and SOX requirements.

• Increase Attack Surface: Every active, exploitable account submitting to the attack surface, providing adversary entry points of the accounts.

• Shared Resourcing: Dormant accounts may be sitting idle, but still consume licenses, storage, and other IT resources thereby contributing to account sprawl.

• Increased Difficulty in Forensics: If dormant accounts are attacked and things go wrong, a lack of legitimate activity will increase the complexity of activity timelines and hinders determining sources of notification.

ReShield provides industry-leading Identity Governance and Administration (IGA) and Identity Security Posture Management (ISPM) solutions that are required for reviewing, detecting and managing dormant accounts whether or not malicious use exceeded acceptable use limitations. By automating and instantiating dormant activity, and reviewing Users Access Reviews (UARs), ReShield authenticates how active/roles your organization has access. Furthermore, we will add intelligence to risk score and develop your response to these dormant accounts such to provide you with a stronger identity security posture, and eliminate these sleeping possibilities of unwanted access through Least Privilege Access.