Shared Admin Credential at a 120-Person Firm
A 120-employee logistics company has 18 contractors who rotate monthly. The help desk uses one shared local administrator account, "admin2," to fix workstation issues; its password is stored in a ticket template visible to all 11 help-desk staff. Badge logs show contractor after-hours access to the server room, but no corresponding change tickets. VPN access uses only a password, and contractor accounts remain enabled for 14 days after departure because HR sends terminations weekly. The CISO has one engineer and a 30-day window before an audit. Management wants no disruption to ticket closure times, currently averaging 22 minutes.
1. What should the security team change first, and how should it sequence the work to reduce the greatest risk without breaking help-desk response times?
Read the worked answer
Prioritize identity and privilege risks that are exploitable without special timing: shared admin credentials and stale contractor accounts. First, replace the shared local admin password with a managed local-admin solution or unique per-technician credentials, and remove the password from the ticket template. This can be piloted with two technicians and a documented break-glass process so ticket closure does not depend on one shared secret. Second, integrate HR termination feeds or require same-day disablement, and audit all contractor accounts for last logon and sponsor. Third, add MFA to VPN for remote and contractor access. Sequence: contain the credential exposure, fix joiner/mover/leaver, then add MFA. Measure median ticket closure time weekly; if it rises, tune the tool rather than reverting to the shared account.
2. How should the team address the after-hours server-room access by contractors?
Read the worked answer
Treat badge anomalies as an access-control and monitoring issue, not just a physical-security issue. Reconcile badge logs against change tickets and VPN sessions for the past 90 days, and interview sponsors for unexplained entries. Restrict contractor badges to escorted access or business-hours zones unless a ticket exists. Add an alert for after-hours entry without an approved change record. Because the server room likely contains network and backup equipment, also verify that logical access controls still require authentication; physical access must not imply domain or administrative access. Document exceptions and review them weekly until the audit.
3. What evidence would show that the changes are working?
Read the worked answer
Use a small set of outcome metrics: percentage of contractor accounts disabled within one business day of termination; number of interactive logons using shared or generic admin accounts; VPN logons without MFA; after-hours badge events with no matching change ticket; and help-desk median ticket closure time. A successful program shows stale accounts trending to zero, no shared admin use, MFA coverage above an agreed target, and stable ticket times. Also sample 10 closed tickets to confirm technicians can still perform fixes without the shared password. Metrics should be reviewed with HR and the help-desk lead, not only security.