Overcoming security team challenges with cloud and SaaS local accounts

Local accounts in cloud and SaaS apps — user accounts created directly within apps rather than through Okta — pose a significant risk to organizations. These accounts increase the attack surface, giving threat actors more opportunities to exploit vulnerabilities and gain unauthorized access to sensitive data and critical systems. 

Security teams struggle to gain visibility into local accounts and their security posture due to fragmented ownership, environmental complexity, and lack of tools. After detecting local accounts, they want to prioritize the most critical and actionable first and proactively reduce risk by ensuring streamlined, automated remediation.

The reality of local account management: It’s complicated

Ideally, all downstream app users should be managed by a central user store in the Identity provider (IdP), like Okta Lifecycle Management. However, many organizations still frequently create local accounts, either because they haven’t implemented these centralization features or because their automation and enforcement processes are incomplete, resulting in a lack of comprehensive synchronization between the IdP and downstream applications.

Some of the most common management gaps with local accounts include:

1. Insecure authentication — Local accounts aren’t subject to centralized multi-factor authentication (MFA) policies, regular password updates, and risk-based session policies (such as Universal Logout) enforced by Okta.
2. Insecure access—Offboarded employees or those who changed roles may still retain access.
3. Excessive privileges — Because local accounts are less visible and excluded from access reviews, they tend to have excessive privileges, lack clear owners, and remain active even if not utilized. 
4. Lack of monitoring — Local account activity often isn’t monitored compared to centrally managed accounts, so unauthorized activities aren’t detected by SOC and incidents cannot be prevented and remediated effectively.

As a result, these gaps can significantly impact your Identity security attack surface, and become:

1. Prime targets for attacks — Threat actors can exploit these vulnerabilities to gain unauthorized access to critical data and inflict damage.
2. Compliance violations — Common hidden spots in auditing include allowing unauthorized access, proper authentication controls not being implemented, and insufficient segregation of duties —, all of which are crucial for frameworks such as SOX, SOC2, PCI-DSS, NIST, and CIS.

How can security teams better handle local accounts?

So, what can modern security teams do? The answer is to apply a simple, Identity posture focused, framework that that lays out the following sequence of steps:

1. Prevention: Eliminate local account creation by implementing lifecycle management provisioning.
2. Continuous visibility: Have an updated comprehensive inventory of your crown jewel identities.
3. Proactive detection: Auto-identify local accounts and SSO bypasses. 
4. Gather context for prioritization:
   1. Is the user account or its privileges in use?
   2. Is it protected by downstream app authentication policies?
   3. What is the blast radius?
   4. What login methods are configured (e.g. API key) in addition to username-password, or is SSO configured in addition to local log-in?
5. Remediation
   Select a remediation plan with a trade-off between immediate risk reduction and minimizing business friction. 
   1. Disable local account:
      1. Immediately
      2. After the access review campaign (e.g. with Okta Identity Governance)
   2. Keep local account enabled but reduce risk.
      1. Remove privileged permissions (keep user enabled)
      2. Reset password
      3. Enable MFA in the downstream app
   3. Replace the local user with an IdP-managed user.

How can Okta help?

With Okta Identity Security Posture Management, Okta provides an overall solution that can help you reduce the security risk related to Cloud/SaaS local accounts. Here are the top 3 critical capabilities for security teams:

1. IT teams can configure lifecycle management to ensure streamlined prevention of local account creation by design.
2. Security teams can use Identity Security Posture Management to trust but verify IT team configurations. They can gain visibility to local accounts with context about their security controls alignment and prioritize the ones that matter most.
3. Security and IT teams can configure Okta Workflows to ensure auto-remediation of new issues detected so no critical risk is missed.

Okta Identity Security Posture Management is part of the Okta Secure Identity Commitment — Okta’s long-term plan to lead the industry in the fight against Identity attacks. We’re committed to arming customers with the products and services they need to secure Identity in today’s ever-changing threat landscape. 

We’re here to help, so contact your Product Manager today to see how Okta Identity Security Posture Management can help you improve your Identity Security posture management and reduce your risk of being breached.