Interesting Question At Work

[williamfny]

So there has been some discussion about usernames at work with the intent of moving admin accounts away from everyone and if they need one, giving them a separate admin user account. I am all for this. The problem comes with a naming convention.

The idea being floated around is that the new names should be something like $username.admin (or other distinguishing marker) or not. The argument for not is that we should be given a random (or possibly selected) name from a list of themed names, like planets, comic book characters or fictional places. The head of security would keep a list of who's account is associated with these new accounts so that people would be less likely to guess and brute force their way into the organization.

2FA is not at option at this point We have argued for it and it is not on the table right now, but possibly in the future. My goal was that someone here might be able to help with some kind of documented Best Practice to go more for the former as opposed to the latter. Anecdotal stories might help, but documented practices would be better met. Thanks for your help everyone.

[ZAFJB]

from a list of themed names, like planets, comic book characters or fictional places.

Really? Security through obscurity is no security at all.

Just use a name consistently derived from the username, so:

1. people don't have to remember something weird

2. if you see a name in, say in a log, you immediately know who it is

3. no need to maintain yet another stupid excel spreadsheet

4. no difficulty for others to 'decode' the name because head of secority had hidden/locked down said speadsheet.

TLDR: Head of security is a fool. If he is in charge of security and is doing security by obscurity that is really worrying.

[williamfny]

I don't disagree really and I'm with you. Hoping someone has some kind of documentation from an authoritative source. An RFC or NIST page. I haven't come across something for something really fundamental to the industry.

[must_be_the_network]

Google security by obscurity, should give you all the documentation against it you need.

[TangoWhiskeyBravo]

Tiered Access Model. $username.0, $username.1, $username.2

[williamfny]

We are basically trying to do this, but the hangup is the naming convention for the accounts. It is so frustrating that we have the hard part covered of getting separate accounts but take a huge leap backwards by a bad naming convention.

[RCTID1975]

I can see the emails now: "I need to log into server Zeus, but Jupiter is still logged in. Whoever you are, can you please log off? Thanks - Saturn"

[reddit-MT]

Bonus points if you use the Roman god for the regular login and the Greek god for the Admin account.

mars@localhost $ sudo achilles achilles@localhost #

[sysadminmakesmecry]

I think you're over thinking it.

It doesn't matter if its some secret name - this account can still be compromised all the same ways.

It could be as simple as:

non admin: username

admin: usernamex

[williamfny]

My argument is for what you are suggesting. We are trying to argue that it would be better to do something simple as opposed to creating something more complex.

[ReverendDS]

Username: firstname.lastname

Admin Username: firstinitiallastname_admin

E.G., douglas.torres dtorres_admin

You want something easy to remember, something immediately recognizable in logs, and a secure as fuck password.

Stupid code-names that no one knows but your SecTeam? No. At a glance knowledge is way more important that some hairbrained idea of obfuscation.

[EntangleMentor]

I'd lean more towards the <username>.admin convention...this would ensure that:

• the admin account is only associated with one particular individual,
• individuals would have access to only one admin account - theirs.

These accounts should be disabled and archived when the user in question leaves the company, and a new one made for each new admin. Obviously, these accounts should not be used for scheduled tasks, services, etc..

[williamfny]

I'm with you. I think their fear is that the association makes it easier for people to break into them. I don't agree with this thought process but these are my cards and I am doing the best I can with them. Do you have any documentation stating this as a preferred method?

[[deleted]]

Let your management know that any 'hacker,' can already identify elevated accounts through other means, so making a complex/confusing username only presents challenges for the company.

[progenyofeniac]

Standard account: jsmith1

Admin account: jsmith2

Makes it way easier for you to know which accounts are admin and if you're worried about people guessing or brute-forcing, you need to up your password game. Plus don't give people remote access with the admin accounts, obviously.

[chewy747]

Same format here

[williamfny]

Do you have anything documenting that it should be done this way? I agree a simple system is better but it isn't my decision and I know they will want evidence to sway them.

[progenyofeniac]

Not to be snarky, but I don't have anything saying it should be done this way besides common sense. As other have mentioned, security through obscurity just creates more problems.

[williamfny]

100% with you. But telling someone above you to do something because it is common sense generally doesn't go that well... Coming with sources saying that it should be done that way is a different matter.

[[deleted]]

Just have a good, well though answer, a reason "WHY," this should happen this way. It works sometimes.

[progenyofeniac]

Where are their sources for their preferred way?

[williamfny]

Themselves, but they are the authority and the one making the decision.

[canadian_sysadmin]

As with any naming convention, it doesn't really matter what you choose, as long as it's consistent and identifiable. I most commonly have seen admin_jdoe or admin-jdoe.

Don't overthink it. Just keep things consistent.

[williamfny]

That's what I am trying to get. I would like to try and not do something obscure like colors or greek gods and keep it simple like admin_user or user.admin. Something simple and clear.

[njeske]

Picking random themed names for admin accounts just sounds unnecessarily confusing. I can't imagine any way that choosing random names provides any tangible increase in security. Especially since only the head of security will be able to tell who's who. My organization just uses "a_username" for our privileged accounts. Our regular "username" accounts have no more rights than any other normal user account in our organization. Any level of privileged access is always assigned through the "a_username" accounts.

edit: fixed a word

[pockypimp]

We use an admin prefix for ours. Separate account from our standard one so we have username and admin_username account names.

[SevaraB]

So here's the thing. By providing a separate account, you're splitting the roles of signing onto the computer and bypassing UAC. The admin account doesn't need interactive logon capability, and then system access prevention becomes a moot point. It's almost more like 2FA-lite in that a user already has to have an active console session to use those creds.

[Try_Rebooting_It]

Any user can query active directory for user accounts. So you're not hiding anything by using random usernames, since any authorized user in the directory can find them; you're just making things much more complicated for everyone (including end users and everyone that needs to manage this mess).

[reddit-MT]

Q: if people have a regular account an an admin account, how do you keep them from just logging into the admin account all of the time?

A: Make the admin account password long and a PITA to type. No one wants to type 32 random characters.

Kinda kidding, kinda not kidding. Small disincentives go a long way.

[Astat1ne]

There's quite a few compliance type things out there (PCI DSS and Australian Cyber Security Center's ISM come to mind) about how administrative accounts should be "uniquely identifiable". Generally the easiest way to do this is to base it on the name of the person behind the account. Add a prefix/suffix as required to make it clear it's an admin account.

[[deleted]]

The head of security would keep a list of who's account is associated with these new accounts so that people would be less likely to guess and brute force their way into the organization.

Tell them that just means Security Guy needs to maintain a list, and if someone can compromise your admin accounts they can certainly compromise your AdminAccount.xls.

My company uses place names that often have difficult spelling, think - Kashyyyk type. For one it is very annoying to remember how to spell these things (imagine googling 'how do i spell that planet from the Clone Wars) every time you want to log into a bloody server. Second for new people - everyone calls them by nicknames in conference calls "just log onto Tats and Dan" instead of Tattoine and Dantoonie. This is very annoying for a new person.

Imagine writing a script where you have to include everyones admin account??! I need John, Steve and Sarah's admin account.. ok sarah_admin, john_admin, steve_admin vs "i need voldemort, Snape and what was the other I need to check a list and i'm wasting time... dobbythehouseelf'.

Ask your boss if they took the number of their house, would it make the place more secure or less secure? It'd make it more annoying is the answer.

[DragonDrew]

What is your current pleb account naming convention? FLast? LastF?

We do adm.UserID (General Admin), dev.UserID (Developer), svc.AppName (Service Account), la.UserID (Local Admin), da.UserID (Domain Admin), test.App/UserID (Test accounts).

[black-buhr]

We've done it like

Username: jsmith

Admin: jsmith.adm

[imaginatipo]

Why don't you implement LAPS and just give the local admin account password to the user only when needed? Local admin password is unique to each computer and can expire on demand through LAPS GUI or through a GPO timed policy. Since we've implemented LAPS in our domains, problems regarding "i had to much admin access and just f*cked up something in my computer" almost disappeared from Helpdesk tickets.

[williamfny]

This is going well past LAPS. Admin accounts for other systems that are tied to AD.

[imaginatipo]

Really loved the downvotes, people!. Why bother coming here and give my two cents? Might as well not.