What are Orphaned Accounts

Orphaned Accounts are user identities that exist in an organization's IT systems and applications that no longer have an owner or legitimate association. They can no longer be associated with a current employee, contractor, partner, or even a non-human identity (NHI). The most common scenario for orphaned accounts is when an individual leaves an organization and their user account (along with appropriate access rights) is not proactively de-provisioned or disabled across all systems.

Think of it like an empty house with the doors unlocked and the keys under the mat. The previous occupant is gone, but the keys are still unlocked, meaning that a hole into an organization's security perimeter remains wide open.

How Orphaned Accounts Come to Exist

• Unsatisfactory Offboarding (mostly manual): This is the biggest offender. When a change occurs with an employee leaving, the offboarding process is sometimes informal and/or inconsistent and fails to revoke appropriate access across all systems (e.g., cloud apps, legacy databases, network shares, development tools, etc.).

• System Disconnects: There is typically no active, automated link between HR systems (which have knowledge of employee changes) and Identity and Access Management (IAM) systems which must actively remove access.

• Merging/Acquisition: When organizations merge, identities from the acquired organization may persist in systems after organizational structure adjustments, even if they do not lead to any issues in access security risks.

• De-provisioning fail scripts: Sometimes de-provisioning may be automated, but it may fail for certain applications or accounts, leaving them orphaned.

• Forgotten Project Accounts: Accounts established for short-term projects, or for outside consultants, in which the project is complete and no cleanup has been done on the account.

The Serious Risks of Orphaned Accounts

Orphaned accounts are a significant security gap and a prime target for attackers. The very nature of orphaned accounts, always active, albeit inactive, makes them attractive as these types of accounts provide attackers stealthy access and then persistence.

Here are some examples of why orphaned accounts are a serious threat:

• Easy Acquisition: An attacker discovers, or compromises, an orphaned account (thru brute force attacks, credential stuffing, leaked passwords, etc.) gives an attacker a nice, stealthy, closed in. There are no legitimate associated user activity to put attention on any suspicious activity.

• Lateral Movement and Privilege Escalation: Orphaned accounts tend to be granted significant privileges, almost equally an account that may have belonged to a former administrator or other highly privileged users. The attacker can leverage the pre-existing permissions for privilege escalation and laterally move across the compromised network to access sensitive data or critical systems.

• Breach and Creating Information Exfiltration Path: Once an attacker obtains access via an orphaned account they could exfiltrate sensitive data, intellectual property, or confidential information, i.e., no one is at home to tell.

• Compliance Issues: Strict and regulated access controls - GDPR, HIPAA, SOX, DPDPA, etc. all mandate strict controls of the lifecycle of identities and controls on data access - orphaned accounts directly violate Least Privilege Access, as well as a lack of auditability and closure of any access and therefore potential non-compliance with regulatory consequences, huge fines, and reputational damage.

• Attack Surface: All orphaned accounts increase the attack surface. Each orphaned account is another vulnerability for the adversary to exploit.

• Insider Threat: While most think attackers are external, insiders exist, and there could be a number of reasons you may have a disgruntled former employee who still has access via an un-de-provisioned account that they could exploited.

• System Bloat and Management Overhead: While not a direct security risk, many orphaned accounts can potentially have the same effect on directories, licenses consumed, and access management themselves.

ReShield has superior Identity Governance and Administration (IGA) features that includes some of the best tools to detect and remediate orphaned accounts across your enterprise. ReShield automates user onboarding, user offboarding, continuously monitors accounts, and streamlines User Access Reviews (UARs), to help organizations to eradicate dangerous digital debris or ghost users and businesses digital hygiene, improving your Identity Security Posture Management (ISPM) and providing continuous compliance.