The principle.
WHY IT MATTERS
Actions are attributable Access can be removed for one person A compromise affects one account Permissions can differ
WHAT SHARED LOGINS COST
No record of who did what A password everyone knows and nobody changes No way to remove one person Two-factor authentication on one device
WHERE SHARED LOGINS APPEAR
A single administrator account used by several people A single email address for a department Social accounts
WHAT TO DO
Create individual accounts wherever the service allows it.
WHERE IT DOES NOT ALLOW IT
A password manager with shared access, so the password can be changed centrally.
WHAT TO DO ABOUT EXISTING SHARED LOGINS
Create individual accounts Change the shared password Remove it from circulation
WHAT TO TELL STAFF
Not to share their own credentials with anyone, including you.
If you need access, use your own account.
WHAT TO REVIEW
Where shared logins still exist.
