Auditor Questions Access to a Shared Admin Account
A 60-person healthcare analytics company stores patient-adjacent data in AWS. During a compliance audit, the auditor finds that six engineers share a single administrative login for the production account. The password is stored in a team wiki, and there is no per-user attribution in logs. The auditor also notes that the company has no formal process for removing access when employees leave; two former contractors still appear in the wiki history. The engineering lead says per-user accounts would slow incident response because the shared login is always available. The company must satisfy an industry framework requiring least privilege, unique identities, and auditable access changes within 90 days.
1. Evaluate the engineering lead's argument that per-user accounts slow incident response.
Read the worked answer
The argument mistakes convenience for speed. A shared credential is fast only in the narrow sense that anyone can grab it, but that speed creates larger delays elsewhere: after an incident, investigators cannot attribute actions to a person, so response stalls while the team reconstructs who did what. The wiki-stored password also means the credential is exposed to anyone who can read the page, widening the blast radius.
Per-user identities with federated access and role assumption do not have to slow response. Engineers can be given time-bound elevated roles that activate quickly during an incident, with the elevation itself logged. That preserves fast access while producing the attribution the auditor requires. The lead's concern is really about process friction, which is solved by designing a smooth elevation path, not by keeping a shared administrative login.
2. Outline the remediation plan that meets the 90-day deadline.
Read the worked answer
Week 1-2: disable the shared login, create individual identities in a central identity provider, and map job functions to roles with least privilege. Give break-glass administrative access only through a reviewed, time-bound elevation process. Week 3-4: rotate every credential the shared login touched, including database and API secrets, and remove the wiki page. Week 5-8: integrate joiner-mover-leaver automation so access is granted and revoked from the HR system, and reconcile the current user list against active employment, removing the former contractors immediately. Week 9-12: enable centralized logging with per-user attribution, alert on anomalous administrative actions, and run an access review signed off by owners. Then commission an internal audit to confirm evidence before the external deadline.
3. What evidence should the company retain to demonstrate compliance?
Read the worked answer
Retain identity records showing each user maps to one person, role definitions documenting least privilege, and approval records for every access grant. Keep elevation logs showing who assumed administrative roles, when, and why. Keep termination tickets and automated deprovisioning logs proving former staff lost access on their last day. Keep periodic access review sign-offs and the rotation record for credentials previously exposed via the wiki. Together these show unique identity, least privilege, and auditable change, which are the auditor's three stated requirements.