Most business systems now keep a log of who changed what, and most support two-factor sign-in. Both are undermined by a habit we find in nearly every company we review: a shared account that everyone uses because it is convenient.
What a shared account costs you
- The log shows that “the IT account” made a change. It cannot tell you which person did.
- When someone leaves, the password has to change for everyone, so it often does not change at all.
- Two-factor codes get forwarded around the office, which defeats their purpose.
- Nobody feels responsible for an account that belongs to everybody.
Why two-factor sign-in matters so much
The US Cybersecurity and Infrastructure Security Agency advises every organization to require multifactor authentication, starting with administrators and anyone who connects remotely. A stolen password is the most common way in. A second factor means the password alone is not enough.
The fix is mostly discipline
- Give each person their own account on every system that supports it.
- Require two-factor sign-in, using an app or a hardware key where you can.
- Keep any shared account that cannot be avoided in a password manager, and limit who can open it.
- Remove access on the day someone leaves, from a written list of the systems they used.
- Have a named person read the security logs on a schedule.
A log that nobody reads is only useful after something has gone wrong.
Related service: IT security & penetration testing.