I have a situation where my employer has a support contract with a vendor for an application we use. This application runs on a (Windows 2008 R2) server that does not store or have access to any information that I would consider to be business confidential or requiring strict security such as credit card, PII, or health-related records. This vendor has support personnel who support hundreds of customers with this type of system.
The question relates to whether or not to force each vendor support contact to have their own credentials for accessing this system via VPN and RDP, or to allow them to share a single generic vendor support account. So far we have created individual user accounts for two of their support contacts.
The vendor is requesting a shared generic account for VPN and remote desktop access instead of individual accounts to help expedite support. Our IT security department understandably does not like this because it makes auditing access and actions difficult if we cannot tie it back to a specific person. On the other hand, I can see the vendor's point of view where they have hundreds of customers and many different people doing support. If each support associate needs an account on every customer's system that is a huge credentials management headache for them.
I can also see situations where remote support is going to be delayed with inevitable password expirations, account lock outs, and so on because a specific vendor support associate only logs on to systems rarely.
Are there best practices for addressing this type of situation?
Does the answer change if other systems in the enterprise, unrelated to this particular system, do contain data which must be kept highly secure?