User Account is a set of information (usually user name, password, personal settings and other) about a user stored by a system. A user account is always assigned to a specific user name. The principle of user accounts is established in all devices (computer, phone, tablet, etc.) and services we sign up for.
The user account allows users to log on to a computer, a computer network, an application (such as banking app), a web site, e-shops, social networks, etc. Nowadays, almost everyone has a user account with Apple (Apple ID) or with Google (Google Account), in order to be able to use the services of these platforms.
From a technical point of view, user account defines the services or resources that may be used by a particular user in that system or service. In most systems, there is only one “normal” (standard) account defined for all regular users. Apart from regular user accounts, there must always be an account with the highest possible permissions usually called administrator account. There might also be accounts with limited permissions which are usually called host accounts.
What types of user accounts are out there?
There are a plethora of different types of user accounts. In practice, we most often encounter the following:
- Computer user account
- Network user account
- Wifi user account
- Email user account
- Domain user account
- Internet banking account
- Online shop account
- Account on social network
- User account enabling subscription of some sort of services
What information does a user account contain?
Because the user account is a user-specific logon, it contains sensitive personal information - especially the username and password that allow to sign up. Leakage or abuse of this information can cause considerable damage, therefore, the user accounts should always be well secured.
- Username (or other user ID)
- Other personal information (e.g. photo, account number, billing information)
- User permissions settings (what actions can the user perform in the system)
- User role
- Custom settings
What are the recommended security principles for user accounts?
- The user account must be unique (see username) and allow to identify the user
- Every user should have an account on their own, no user account shall ever be operated by several users
- The user shall not share the password with others (neither do they stick the password on their screen or elsewhere)
- The password should be strong enough
- If a user account contains sensitive data, multi-factor authentication shall be used