COI Report – Part VII
Page
312 of
425 (h) Alert on Account Login Behavior Deviation - Alert when service accounts deviate
from normal login behavior, such as time-of-day, workstation location and duration. i) Not hardcoding or including administrator credentials in cleartext in scripts on servers - In addition to having carried out a scan to identify all scripts containing administrator credentials in text files stored
in shared folders on servers, we note that IHiS plans to continue to conduct such scans periodically and take disciplinary action on administrators who are found to not comply with security policies on the creation of such scripts.
40.6.2 Create and maintain an inventory of service accounts, and disable accounts which are unnecessary 909. Locking down service accounts must be a basic component of the hardening strategy for servers. An inventory of all existing service
accounts must be created, and existing privileges should be reviewed with the view to granting the least privileges necessary. When new servers are provisioned, specific regard should be given to reviewing the service
accounts that are created, and whether such service accounts (and the underlying service) are necessary. Unnecessary accounts should be disabled as part of basic account administration hygiene.
