What are the industry recommendations on usernames?

Question

We're having an internal debate within the NHS organisation I work for, around securing admin usernames. Our usernames are generally based on our names (e.g. tom jones username = tojo0001). Admin usernames are based on the low-level account (e.g. tom jones admin = a.tojo0001).

Some of the team want to randomise admin usernames so that tom jones admin = tyl99123). Whilst I see the security benefit of the random username, it feels clunky and less manageable. In addition, our systems authentication requires a strong password, multifactor authentication, compliant device and low sign-in risk (from online risk analysis).

In these circumstances, I believe randomising usernames is a low-security benefit vs a high management overhead.

Are there any official NIST, NCSC, ISO or OWASP recommendations on this?

Answer 1

Most of the user names are based on the actual name. 1-3 letters of name + surname or similar combinations. Admins are no exceptions.

For the administrative side, many use the ABC format:

a-names are the main admins of the company with the highest access

b-names are the secondary admins with lower access (low-med support) or backup/recovery admin accounts

c-names are the contractors with very limited access (like L1 contractor support)

Some companies prefer for the simplification of things to use the employee ID which is usually a 3 or more digits number. It simplifies many administrative tasks, not only IT-related.

Randomization of a-names is a time killer, it's not recommended. And it does not improve security much; any user can see that name if it ever accessed its device. You can improve your security by using well managed account access, with transparent access boards and on-spot generated and allocated passwords for highest levels of access.

A general recommendation is of course not to use the same account for daily work and administrative tasks. That means that you will have your standard account (name or number ) and a different one with privileges (a-name or a-number ).

As a standardization, there is no universal rule; each company will decide on a template for that and go with it. Then it rarely ever changes, except if they are brought by another bigger company that comes with its own rules.