In IT, we like to preach that users should never share passwords. We try very hard to avoid shared accounts for services and devices. Unfortunately, a Dimensional Research study says that just over half (56%) of users have reported sharing their password with others.
As IT professionals, that statistic could most definitely scare us.
With identity theft rampant, a hack being announced daily, and users being bombarded with security messages, how is it that our workforce still thinks that it is acceptable to share passwords? Unfortunately, they do. And, it isn’t a small problem – it’s a big problem.
Of course, we could treat the symptom by educating our workforce to stop sharing passwords. We should do that and continue to do that. It’s a message that will only grow more important. In fact, we probably should start that message to children today who have online accounts.
The Reasons Behind Password Sharing
But to understand the root of this problem, we need to start by asking the question, why? Why would a worker be compelled to share their password with a coworker?
Let’s take the most obvious case: the coworker needs access to some data or an application to help do their job. It’s likely faster for the coworker to ask for credentials rather than go to IT to get the account provisioned.
Sometimes there is a cost issue and users are doubling up on credentials in order to save the company money. But shared credentials on an application is likely against the term of service of the particular application.
In the end, there is no acceptable reason for users to share passwords. It should be fast and easy for a worker to request access to a system or application. IT should be able to quickly and easily provision and de-provision access for them.
How IT can Prevent Password Sharing
It’s our job as IT professionals to not only educate our workers that they shouldn’t share passwords, but also to make it easy for workers to have access to whatever they need to do their jobs.
That starts with IT having systems that are able to easily execute on that promise. Centralized user management systems are what IT needs, but unfortunately legacy solutions such as Microsoft® Active Directory® or OpenLDAP™ only cover a portion of the overall IT infrastructure. As a result, IT organizations are left with a handful of conventional options:
- manually control access
- leverage scripts or home grown solutions
- purchase expensive enterprise-class, on-premises systems
None of those solutions sound appealing to IT admins.
There is a Better Way
A platform called JumpCloud® Directory-as-a-Service® is a cross-platform cloud-based centralized user management system. With DaaS in effect, IT can easily and quickly add access to systems, applications, and networks. In fact, IT can group types of users and IT resources to easily provide access to everything a type of employee may need. All with one setting.
Now, there is no reason for users to share passwords and go around IT. IT admins can quickly and easily grant access across virtually any type of IT resource. This – along with continuing education – can solve the problem of sharing passwords for your workforce.