What goes wrong.
REUSED PASSWORDS
A breach elsewhere becomes a breach here.
SHARED LOGINS
No attribution, no way to remove one person.
NO TWO-FACTOR AUTHENTICATION
A stolen password is enough.
RECOVERY CODES ON THE SAME DEVICE
Lost together.
RECOVERY EMAIL ON YOUR OWN DOMAIN
If the domain fails, recovery fails.
ADMINISTRATOR ACCESS FOR EVERYONE
Simplest, and the most damaging when something goes wrong.
ACCESS NOT REMOVED WHEN PEOPLE LEAVE
The most commonly neglected action.
CREDENTIALS SENT BY EMAIL
Remaining in mailboxes indefinitely.
GIVING CONTRACTORS YOUR OWN LOGIN
Access to everything, revocable only by changing your own password.
NEVER AUDITING
Accounts accumulating for years.
ASSUMING IT DOES NOT MATTER
Until it does.
