Concepts of service account and communication account Broadcom PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Clarification of the concepts of Service Accounts and Communication Accounts at some point in the Privileged Access Management documentation to serve a client that uses CA Privileged Access Management.

Define what is...
A service account and
a communication account
According to what is reviewed in different sources, it should:

• Service account

According to information provided by the manufacturer, in the security solution environment such as PAM, a service account is defined as a user account created expressly to provide a security context for services running on devices. Windows or Linux Server operating systems.
The security context determines the service's ability to access local and network resources. In the case of Windows operating systems, they are used to run various services or features. These services can be configured through Applications, the Services snap-in or Task Manager, or through Windows PowerShell.

These service accounts are classified as privileged accounts because they have elevated privileges and permissions on an IT system. Service accounts often require elevated privileges to perform specific tasks, such as accessing sensitive data or performing administrative functions.

Systems administration generally involves setting up service accounts to access resources and services within a network. However, it is essential to understand how the privileges of these accounts can impact system administration and security. In this context, using a proxy may require a specific service account, whose privileges may be limited to a domain user. However, to enable "local system" administration, this service account must be a member of the local administrators group on the target managed account server. This requirement ensures that the service account has the necessary privileges to perform required management tasks effectively and securely.

• Communication account

A communication account is an unnamed account created specifically to enable communication and interaction between multiple applications and/or systems.
Communication accounts are intended to represent the identity and authorization of an application or service. They serve as a means for applications to authenticate and interact with other systems, databases, web portals, or resources.

Communication accounts have several important features:
• Authorization and permissions: Communication accounts are associated with specific permissions and roles that determine what actions can be performed on other systems or resources. These permissions are used to ensure that only authorized operations are performed and that security and privacy limits are respected.

• Security: Communication accounts are protected with appropriate security measures, such as two-factor authentication, access tokens, digital certificates, or other secure authentication mechanisms. This helps prevent unauthorized access and protects data integrity during communication.

• Integration and automation: Facilitate the integration and automation of processes between different systems or applications. By using communication accounts, organizations can establish automated workflows to share data, synchronize systems, and perform repetitive tasks efficiently.

In short, a privileged communications account in Symantec Privileged Access Manager is a special account used to facilitate privileged access management

There is no official information on the Broadcom website and it is necessary to provide customer service.

Resolution

Search the docops by "service account" will say:

1. PAM Windows Proxy Connector

"To use the Windows Proxy to manage Domain accounts, add the service account to the domain Account Operators group. To enable "local system" management, the service account must be a member of the Local Administrator group on the managed Target Account server."

2. PAM can discover MS Active Directory Services and Scheduled Tasks and you can use service account as one account used to rotate passwords of other accounts.

3. Related to "Communication Account" there is not this concept explicitly in our Symantec Privileged Access Management documentation. What seems similar to this concept in PAM and the concept of  target accounts used for auto-login and A2A accounts. The A2A Client manages the connection between Privileged Access Manager and a request server. The A2A Client runs on a request server and allows requestors to communicate securely with the appliance. accounts.