1

What are the security risks of encouraging, supporting and allowing shared logins to our website (username / password)?

This feature would allow some number of users, normally working for the same organization, to all use a single login to the website and perform the same functions as that login with no further identifying info.

Several users and some of the business stakeholders are asking that we support and encourage shared logins to one of our new websites. I have no idea why they are asking for this yet. The website does not have anything to do with the health industry and no financial information will be tracked in it.

There are immediately some architecture and UX problems I have with this 'feature' but I am looking for any security risks/concerns to back up my other gripes.

  • 2
    SANS publish a white paper on the issues of shared accounts which may be useful if you need to quote something published to support your claims. sans.org/reading-room/whitepapers/basics/… First issue that comes to mind is audit / non-repudiation. – iainpb Jan 31 '17 at 13:36
4

Concerns regarding shared accounts:

  1. The audit trail becomes an issue, since there is no valid audit trail possible. When the audit trail is not properly in place, accountability becomes an issue.

  2. Loss of credentials to unauthorized users is significantly increased.

  3. Once an account is compromised, the impact is high since many users share the same account.

  4. Password policies no longer apply. Regularly changing passwords is not a viable option anymore. If the password would regularly be changed, how is the new password communicated to all your users?

Probably one could come up with a few more concerns here. The fact that you do not understand why they are asking you this question is interesting to me.

Apparently they have an issue and think they have the best solution for this problem already and ask you to implement it this way.

I personally would go back to them and try to determine the problem. Once the problem is determined, a proper and secure solution could be considered.

1

The problem with share logins is that they to not allow to have a authenticated human being liable for anything that is done under his/her account unless he can prove he/she is not.

Whether this is useful in your use case, I cannot say. I only know that the non accountability is seen as a poor security practice, and individual accounts are the rule nowadays.

Historically, an account was in fact a role and all users with same role shared same account. Then because of accountability, security encouraged to have individual accounts sharing roles. That is an educational question, and it is harder when several users both share same role and same machines: the simplest from their point of view is that one single login is used and the one that is in front of the machine does the job. But it is then impossible in case of a problem to identify who is liable for it.

Not speaking of the problem of changing the password of a shared account...

1

There are some great reasons listed in the other answers. Here's another one:

When someone leaves their company (which will happen, sooner or later), you'll have to change the password for everyone in order to remove access for that one person.

This often ends up being such a pain that companies don't do it at all, which means past employees continue to have access. A recent example are the Trump-criticising tweets from the Badlands National Park Twitter account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.