The Contractor's Shared Credentials
A healthcare billing company uses a single shared administrator account for its cloud billing platform, with the password stored in a spreadsheet on a shared drive. Three internal staff and two contractors from a vendor use it. The vendor's contract requires access for a six-month project that is now in month four. An audit finds the account has no multi-factor authentication, and logs show logins from two countries at overlapping times on several days. The security lead wants to disable the account immediately and rotate the password. The billing operations manager objects: disabling it mid-cycle would halt claims processing for at least two days, and the vendor would miss a contractual milestone. The company is subject to healthcare privacy rules, and the platform holds patient billing records. No evidence of data exfiltration has been found, but logs are retained for only 30 days.
1. Evaluate the security lead's and the operations manager's positions. What risk factors in the setup should drive the decision?
Read the worked answer
Both positions contain valid elements, but neither is complete.
Security lead - correct on the control gap, too blunt on execution. A shared admin account with no MFA, a password in a shared spreadsheet, and five people using one identity is a serious control failure. Overlapping logins from two countries is a strong indicator of credential misuse or unauthorized sharing. The instinct to act is right.
Operations manager - correct on business impact, wrong to let it veto. A two-day halt and a missed milestone are real costs, but they are recoverable; a breach of patient billing records is not, and regulatory exposure compounds it. Business continuity is a constraint on how to fix the problem, not a reason to defer it.
Risk factors that should drive the decision:
- Identifiability. Shared credentials destroy accountability - you cannot attribute the foreign logins to a person, which is precisely why the anomaly cannot be resolved.
- Detection blindness. 30-day log retention means evidence of earlier access may already be gone. Absence of proof of exfiltration is not proof of absence.
- Regulatory weight. Patient billing data raises notification and penalty exposure if misuse is confirmed later.
- Contractual leverage. The vendor is in month four of six, giving the company standing to impose access conditions now.
Conclusion: the account must be eliminated, but through a controlled cutover rather than an unplanned outage.
2. Design a remediation plan that closes the control gap without an unplanned two-day outage. Include how to handle the contractor access and the evidence problem.
Read the worked answer
Immediate (within 24 hours):
- Rotate the shared password and enable MFA on the admin account, restricting it to a break-glass role held by named staff.
- Preserve and export all available logs before the 30-day window rolls off; extend retention going forward.
- Review the foreign logins against the vendor's known locations and staff travel; interview the five users.
Short-term (days):
- Issue individual named accounts with least privilege, MFA, and role-based permissions. Contractors get time-bound accounts scoped to the project, expiring at month six.
- Migrate claims processing to the new accounts in a planned window with a tested rollback, so the cutover is hours, not days. Schedule it outside the cycle boundary to protect the milestone.
- Revoke the shared credential only after each user is confirmed on a named account.
Contractor handling:
- Amend the vendor agreement to require named users, MFA, and acceptance of access terms; tie continued access to compliance.
- Require the vendor to attest which personnel accessed the platform and from where.
Evidence and governance:
- If the foreign logins cannot be attributed, treat it as a suspected incident: run a focused investigation, consider notifying per policy and counsel's advice, and document the decision either way.
- Eliminate shared-drive password storage; adopt a secrets manager.
- Set log retention to at least 12 months.
Framing for the operations manager: the plan protects the milestone by sequencing the cutover, so the choice is not security versus continuity.