1

We're having an internal debate within the NHS organisation I work for, around securing admin usernames. Our usernames are generally based on our names (e.g. tom jones username = tojo0001). Admin usernames are based on the low-level account (e.g. tom jones admin = a.tojo0001).

Some of the team want to randomise admin usernames so that tom jones admin = tyl99123). Whilst I see the security benefit of the random username, it feels clunky and less manageable. In addition, our systems authentication requires a strong password, multifactor authentication, compliant device and low sign-in risk (from online risk analysis).

In these circumstances, I believe randomising usernames is a low-security benefit vs a high management overhead.

Are there any official NIST, NCSC, ISO or OWASP recommendations on this?

2

Most of the user names are based on the actual name. 1-3 letters of name + surname or similar combinations. Admins are no exceptions.

For the administrative side, many use the ABC format:

a-names are the main admins of the company with the highest access

b-names are the secondary admins with lower access (low-med support) or backup/recovery admin accounts

c-names are the contractors with very limited access (like L1 contractor support)

Some companies prefer for the simplification of things to use the employee ID which is usually a 3 or more digits number. It simplifies many administrative tasks, not only IT-related.

Randomization of a-names is a time killer, it's not recommended. And it does not improve security much; any user can see that name if it ever accessed its device. You can improve your security by using well managed account access, with transparent access boards and on-spot generated and allocated passwords for highest levels of access.

A general recommendation is of course not to use the same account for daily work and administrative tasks. That means that you will have your standard account (name or number ) and a different one with privileges (a-name or a-number ).

As a standardization, there is no universal rule; each company will decide on a template for that and go with it. Then it rarely ever changes, except if they are brought by another bigger company that comes with its own rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.