A company I work with has a number of mobile devices that are used primarily for testing apps and websites.

I have advised that to improve security it would be best for each device to be assigned to a specific staff member, and for this staff member to use their company email address to sign in to the device.

My reasoning being that there is then just a single person who knows the password for the device, and when the staff member leaves the company, the device can simply be factory-reset and re-assigned to another person, and the email address deleted.

Other people have disagreed on this point, and feel it would better to sign in to the devices with a generic email address which is shared with the rest of the team.

This seems wrong to me, but I would like to get some some concrete reasons as to why, to try to better present my case.

A couple of reasons that I can think of...

  1. The password/pin is likely to be intentionally simple to help multiple staff members remember it.
  2. If a staff member leaves, the password for the shared email account will need to be changed, and any devices linked to it will need to be re-authenticated.
  3. Often mobile devices request that users add additional password recovery options, such as a phone number, or additional email address. Even if the device is technically shared, it's possible it may end up linked to an individuals personal phone number or email account through these password recovery options.
  • What are you protecting? How important is it to protect this asset? Does individual user authentication add any security in this scenario? Whom is your (likely) attacker? Does the device ever leave company premises? In short: a common authentication may in many cases be desirable and plenty secure. It all depends on the scenario.
    – vidarlo
    Oct 7 '20 at 10:42
  • The devices often have pre-release apps installed, and the browsers may have saved website credentials etc. I don't have a spacific attacker in mind, however as with any moderate sized company there is always the risks associated with disgruntled ex-employees. Hyperthetically an ex-employee with access to the shared email account, may be able to obtain pre-release apps which they could give or sell to a competitor, or which may not be properly secured, potentially exposing proprietory company data. Oct 7 '20 at 12:21
  • If this risk is big enough to outweigh the inconvinences or added costs, then secure the setup. If not, continue as current practice. This is not something we can answer for you.
    – vidarlo
    Oct 7 '20 at 14:15
  • I'm looking for some reasons, in addition to those I've highlighted, to help explain why sharing accounts in this way is not a good idea. All company security policies specifically prohibit sharing passwords. There must be some good reasons for this. Everything I've found on the subject is a bit vague. Oct 7 '20 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.