The Password Reuse Problem
A small charity has 9 staff and 3 volunteers. Staff share one 'admin' login for the donor database because volunteers rotate and 'it's simpler'. The admin password is 'Charity2024!' and has not changed in two years. It is written on a sticky note inside a desk drawer. Two staff use the same password for their personal email. The charity has just learned that a unrelated website where one staff member registered with that same password suffered a data breach. The donor database holds names, addresses and donation amounts. The charity cannot afford a paid password manager but has a modest IT budget and uses a cloud email service with multi-factor authentication available at no cost.
1. Explain why the shared admin login and the reused password together create a serious risk, and identify the specific threat path.
Read the worked answer
Shared login problems:
- No accountability: actions in the donor database cannot be attributed to a person.
- No least privilege: everyone with the login has full admin rights, including rotating volunteers.
- Offboarding is impossible: when a volunteer leaves, the password is still known to them unless changed for everyone.
Reuse problem:
- Two staff use the same password for personal email. If that password appears in the unrelated breach (credential stuffing), attackers can try it against the charity's systems.
- The password is also written down in an accessible place, so anyone with physical access can read it.
Threat path: A breached password from the unrelated site is used to attempt login to the donor database (or personal email, then password reset of other accounts). Because the admin login is shared and unchanged for two years, a single successful guess gives full access to all donor records with no way to tell who did it.
2. Recommend changes that fit a small budget, prioritising the highest-impact actions first.
Read the worked answer
Priority 1 - stop the reuse and the shared login.
- Give every person their own named account with role-appropriate rights (volunteers read-only; staff limited write; one or two admins).
- Force a password change on the admin account and retire the shared login.
- Tell the two staff to change the reused password everywhere it was used, starting with personal email.
Priority 2 - turn on free multi-factor authentication on the cloud email service and, if the donor database supports it, on that too. MFA defeats credential stuffing even when a password leaks.
Priority 3 - remove the sticky note and use a free, reputable password manager (free tiers exist) or the browser's built-in manager with a strong master password.
Priority 4 - basic hygiene: unique passwords per account, a documented offboarding step that disables accounts when volunteers leave, and a review of who has admin rights.
Why this order: Reuse and shared accounts are the exploitable weaknesses; MFA is free and high-impact; the rest reduces future recurrence at little cost.