Skip to main content
Notice removed Canonical answer required by Eloy Roldán Paredes
Bounty Ended with CristianTM's answer chosen by Eloy Roldán Paredes

Imagine I have a group of users called "support" that participates solving different kinds of problems. Each user has a nominal username like jsmith that has not much privileges but additional everyone in this group uses two different user accounts: operator and administrator. Each account has different additional privileges. Administrator has administrator privileges and operator can login to a lot of different systems in order to perform different operations.

Now I'm trying to eliminate the use of generic usernames like operator and administrator in order to have trazabilityaccountability and be able to identify who has performed an action. However, would security be improved if I give operator and administrator privileges to each nominal account? I think the security would decrease because one user account would accumulate a lot of privileges (like using root in everyday work).

How can I do this trazabilityaccountability and mantainmaintain segregation and security?

Is best practice to create users adm_jsmith and oper_jsmith? This would affect usability because users would need to change between users everytimeevery time they need to do a different action.

Imagine I have a group of users called "support" that participates solving different kinds of problems. Each user has a nominal username like jsmith that has not much privileges but additional everyone in this group uses two different user accounts: operator and administrator. Each account has different additional privileges. Administrator has administrator privileges and operator can login to a lot of different systems in order to perform different operations.

Now I'm trying to eliminate the use of generic usernames like operator and administrator in order to have trazability and be able to identify who has performed an action. However, would security be improved if I give operator and administrator privileges to each nominal account? I think the security would decrease because one user account would accumulate a lot of privileges (like using root in everyday work).

How can I do this trazability and mantain segregation and security?

Is best practice to create users adm_jsmith and oper_jsmith? This would affect usability because users would need to change between users everytime they need to do a different action.

Imagine I have a group of users called "support" that participates solving different kinds of problems. Each user has a nominal username like jsmith that has not much privileges but additional everyone in this group uses two different user accounts: operator and administrator. Each account has different additional privileges. Administrator has administrator privileges and operator can login to a lot of different systems in order to perform different operations.

Now I'm trying to eliminate the use of generic usernames like operator and administrator in order to have accountability and be able to identify who has performed an action. However, would security be improved if I give operator and administrator privileges to each nominal account? I think the security would decrease because one user account would accumulate a lot of privileges (like using root in everyday work).

How can I do this accountability and maintain segregation and security?

Is best practice to create users adm_jsmith and oper_jsmith? This would affect usability because users would need to change between users every time they need to do a different action.

Tweeted twitter.com/StackSecurity/status/740563146893594629
Notice added Canonical answer required by Eloy Roldán Paredes
Bounty Started worth 50 reputation by Eloy Roldán Paredes
Source Link

May be justified to use generic and shared user accounts in order to segregate and reduce risk?

Imagine I have a group of users called "support" that participates solving different kinds of problems. Each user has a nominal username like jsmith that has not much privileges but additional everyone in this group uses two different user accounts: operator and administrator. Each account has different additional privileges. Administrator has administrator privileges and operator can login to a lot of different systems in order to perform different operations.

Now I'm trying to eliminate the use of generic usernames like operator and administrator in order to have trazability and be able to identify who has performed an action. However, would security be improved if I give operator and administrator privileges to each nominal account? I think the security would decrease because one user account would accumulate a lot of privileges (like using root in everyday work).

How can I do this trazability and mantain segregation and security?

Is best practice to create users adm_jsmith and oper_jsmith? This would affect usability because users would need to change between users everytime they need to do a different action.