Password Policy: Sharing Passwords
This is a guest post by W. Benson Dana, IT internal auditor for the Maine state government.
At one point in my career, I worked at a place where management in one unit had allowed a senior manager to collect the log on and email passwords of the employees of the unit. There had been complete resistance to giving up this policy, and the excuse was that this unit’s mission and objectives were unique (how many times does the internal auditor hear this excuse?) and that this arrangement was absolutely necessary.
I called a meeting and here is my description of the meeting agenda:
« We will discuss the specific IT security policy that prohibits the sharing of passwords. I understand that the unit has a policy that the Assistant Director must have the AD (Active Directory) password of at least a subset of the unit’s employees if not all. This would be a direct violation of the IT security policy. I am not interested in discussing any other aspect of IT policies or operations, past or present.
I am not aware of any other unit in the company with a similar policy. If it were, that unit would receive the same degree of scrutiny. I am not interested in discussing any other unit’s policies or procedures, unless anyone knows of a similar policy.
Your AD password is unique to you and is not known by anyone else unless you share it, overtly or inadvertently. The members of the help desk who are so authorized CAN reset your password if you forget it. When that happens, you type in a NEW password that is again unknown to anyone else.
Our IT systems monitor when passwords are changed, but not what the password is.
The prohibition to sharing passwords is a basic and standard internal control around the world. One of its primary purposes is to protect OTHER employees from inappropriate suspicion in the event that account is used for inappropriate purposes.
This is similar in concept to the requirement that each cashier use their own cash drawer instead of a shared cash register drawer. If 2 people share a cash drawer, and one steals, they both come under suspicion. The employer owes its employees a duty to see that their employees cannot be falsely accused of inappropriate conduct.
If a password is shared, the person who knows another’s password now becomes automatically suspect whenever that user’s account is used for inappropriate, illegal or unethical purposes. One of the 2 WILL be falsely accused of the violation. If the matter is not resolved, they BOTH will remain under the cloud of suspicion. That is a BAD result.
Every employee in history who has been convicted of theft, embezzlement, or other crime was hired as a trusted employee. This policy has nothing to do with trust. The Maine Attorney General’s office recently terminated the employment of an employee, licensed to practice law in Maine, who is accused in connection to a pornography violation. Until this was brought to light, this lawyer was considered a trusted employee above reproach. I am not interested in discussing anything related to trusting employees.
Are passwords inadvertently shared? Probably. Does that make it right or smart? No.
In the case when an employee has a planned leave, email can simply be forwarded to another person. In the event an employee is sick, they can usually manage to log on, activate the forwarding feature, and log off. In an emergency situation, the help desk can perform this action. I’m interested in knowing how many such emergency situations have occurred in the past 6 to 12 months. I am not inclined to plumb the depths of history with respect to this one aspect of the discussion. »
I was successful in getting the unit to stop sharing passwords.
Prevent concurrent logins
W. Benson Dana is perfectly right here: password sharing creates accountability and non-repudiation issue as user A, connected to the network with the credentials of user B, can access user B’s data and applications, send e-mails in his/her name, etc.
Passwords can be shared inadvertently (ever seen a password written on a Post-it note and attached to a monitor?) or consciously (a manager does not want to approve purchase requisitions and so just logs on for one of his subordinates and then allows him to approve each purchase requisitionin his place) .Educating users about the dangers of such practices is a good thing but is it good enough?
Human beings usually need to be properly motivated to adopt best practices and follow rules and policy.
UserLock comes handy here, as this unique software solution prevents (among numerous other security features) concurrent logins to a Windows network.
On a UserLock-protected network, a user cannot share his password without taking a major risk of being unable to logon himself. Can you think of better motivation?
