A company I work with has a number of mobile devices that are used primarily for testing apps and websites.
I have advised that to improve security it would be best for each device to be assigned to a specific staff member, and for this staff member to use their company email address to sign in to the device.
My reasoning being that there is then just a single person who knows the password for the device, and when the staff member leaves the company, the device can simply be factory-reset and re-assigned to another person, and the email address deleted.
Other people have disagreed on this point, and feel it would better to sign in to the devices with a generic email address which is shared with the rest of the team.
This seems wrong to me, but I would like to get some some concrete reasons as to why, to try to better present my case.
A couple of reasons that I can think of...
- The password/pin is likely to be intentionally simple to help multiple staff members remember it.
- If a staff member leaves, the password for the shared email account will need to be changed, and any devices linked to it will need to be re-authenticated.
- Often mobile devices request that users add additional password recovery options, such as a phone number, or additional email address. Even if the device is technically shared, it's possible it may end up linked to an individuals personal phone number or email account through these password recovery options.