We have a windows service running under the LocalSystem account running on a server. We have a separate server holding attachments for our application that may contain PHI. Today this attachments folder is not accessible to our windows service. We cannot control the server or what applications are installed on this server.
What we want to do
We want to have access to this attachments folder from our windows service.
Our proposed solution
We are considering recommending our clients grant the LocalSystem account access to this attachments folder. It is my understanding that this will allow all services access to this folder along with anything on that server impersonating the LocalSystem account.
Since we are not in control of this server other applications will be running on this server possibly under the LocalSystem account. Other applications may have public facing IIS websites configured using the LocalSystem account (Hopefully not). The point being I am worried about recommending something that could cause these PHI documents to be accessed in an unintended way. I much rather prefer a dedicated network account being built but I am trying to understand if my concern is warranted about granting the LocalSystem account access.
Would this be considered bad practice? Does this open us up to more security risks?