Send us the RFP Sign up free
Sign up free Send us the RFP
Back to course

P4 Shared Accounts and Offboarding

0% done: 0 of 6 lessons

Lesson 2 of 6 · Simulation

One person, one account

Progress is saved on this device only. Keep it across devices with a free LFW account.

Curriculum0 of 6 done

Simulation

Replace a shared login with one account per person

A working copy of the real screen. Use it as you would the real one. Nothing you type leaves this page.

This exercise runs in your browser and needs JavaScript. The lesson text above covers the same steps.

Not done yet.

Give each person their own login wherever the service allows it, so you can see who did what, remove one person without locking out the rest and protect each login with its own second step.

Notes

Step 1 of 6

Start here

Shared logins are common in small institutions. One "admin" account for the website, one password for the social media page, one login for the newsletter, known to whoever has needed it over the years. They are convenient until something goes wrong, and then they make it worse.

This lesson replaces shared logins with individual ones wherever the service allows.

Step 2 of 6

What a shared login costs you

  • No record of who did what. The website's log says "admin" changed the page. Five people are admin.
  • No clean way to remove one person. When someone leaves, you change the password and tell everyone else, or you leave it and hope.
  • No real two-step sign-in. The second step goes to one person's phone, so either that person is always needed, or the second step is turned off.
  • One stolen password opens everything that login can do.

CISA's Cybersecurity Performance Goals call for unique credentials (goal 3.C) and multi-factor authentication using the strongest method available (3.F). Individual accounts make both possible.

Step 3 of 6

Most services support individual logins

Before you assume a service has one login, check its settings for "users," "team," "members," "roles" or "people." Most do:

  • Websites: WordPress, Drupal and most hosted website builders let you add users with roles.
  • Social media: the major platforms let a page or business account have several people, each signed in as themselves, with roles.
  • Hosting, DNS and registrars: most offer team members or delegated access.
  • Newsletter, forms and analytics services: most have team or user settings, sometimes on paid plans only.

Give each person their own login, with their own institutional email address and their own two-step sign-in.

Step 4 of 6

When a login truly must be shared

Some services allow only one account, or charge for more. For those:

  1. Use a role mailbox as the login email, such as webmaster@ or clerk@, read by at least two people. Never a personal address.
  2. Keep the password in a shared vault in the institution's password manager, limited to the people who need it.
  3. Set up two-step sign-in the backup can reach. Many password managers can store the code generator for a login in the shared vault. A second security key registered to the same account is another option.
  4. Record who has access in your inventory from lesson 1.
  5. Change the password whenever someone with access leaves.

Step 5 of 6

Personal accounts used for work

A common pattern: the town's social media page is managed through a staff member's personal account. That can be acceptable on platforms that require a personal profile to manage a page, as long as at least two staff have admin roles on the page, and the page belongs to the institution's business account where the platform offers one. Record each person in the inventory.

Step 6 of 6

Moving from shared to individual

Do it one service at a time, starting with the most important (the registrar and website first):

  1. Create individual accounts for the people who need access, with the right role (lesson 3).
  2. Have each person sign in and turn on two-step sign-in.
  3. Change the shared password, and store it in the vault for emergencies only, or disable the shared account if the service allows.
  4. Update the inventory.

Sources

Task

Your task at your institution

Quiz

4 questions. Choose one answer for each, then check them. Each answer shows its reason.

1. Five staff share one website administrator login. Someone deletes a page by mistake. What can you tell from the website's records?
2. One of those five leaves. What must happen with a shared password?
3. What does CISA's goal 3.C, Create Unique Credentials, call for?
4. A service allows only one login. What is the safest way to share it?
Show the answers
  1. B. Only that the shared login did it. A shared login makes everyone the same person in the records.
  2. B. It must be changed, and the new one given to the other four. Everyone who knew it still knows it. With individual logins, you would disable one account instead.
  3. B. Distinct and separate credentials for similar services and asset access. Unique credentials limit what one stolen password can open.
  4. B. Keep it in a shared password manager vault with a role mailbox as the login and a second step the backup can reach. The vault controls who can see it, the role mailbox outlives any one job, and the backup can still sign in.