Funding one identity project for a hospital with shared ward logins
Meridian Health has 4,200 staff and 1,100 contractors. Clinical teams share 300 ward workstations and often use a colleague's credentials during shift handover because full re-authentication interrupts care. The identity team is rolling out FIDO2 keys for administrators, but the electronic patient record (EPR) only supports a username, password and four-digit PIN; SAML federation is promised in a vendor release due in nine months. Active Directory has 62 members of Domain Admins, 21 of them service accounts with non-expiring passwords. An audit found 14 enabled accounts belonging to contractors who left more than 90 days ago, and password resets generate 31% of service-desk tickets. The CISO has budget for one major identity project this year. The clinical director will not accept anything that adds more than five seconds to login during handover; the finance director wants proof that the project reduces help-desk cost as well as risk.
1. Which single identity project should be funded? Compare at least two alternatives and justify the choice against the stated constraints.
Read the worked answer
Comparison. (a) Enterprise MFA is strongest long term, but the EPR only supports password plus PIN and federation is nine months away; forcing MFA on shared ward devices would add a second login and break the five-second constraint. (b) Self-service password reset directly attacks 31% of tickets and helps the finance case, but does nothing about 62 Domain Admins or 21 service accounts with non-expiring passwords. (c) Privileged access management with service-account remediation and tiered administration.
Recommendation: (c). The highest-impact single failure is a Tier-0 compromise. One non-expiring service-account password gives an attacker domain-wide control, and a domain-wide ransomware event would take the EPR offline, which is worse than slow logins. PAM can vault privileged credentials, replace service accounts with group managed service accounts where possible, enforce checkout and rotation, and remove standing Domain Admin rights. Disabling the 14 orphaned contractor accounts is a no-cost day-one action, not a project.
Handling the constraints. The clinical director's five-second rule is respected because this project does not touch ward logins. The finance director gets a quantified story: fewer privileged password resets, fewer standing admin accounts, and avoided incident cost. I would commit to self-service password reset as the next funded phase, using help-desk savings and the identity inventory built here. If the board insists on ticket reduction first, the fallback is self-service reset plus lifecycle automation, but I would document that Tier-0 risk remains.
2. What interim controls would you put on the shared ward workstations without waiting for the EPR vendor?
Read the worked answer
Interim controls should make sharing harder and auditable without pretending the EPR is fixed. First, eliminate generic ward accounts and require unique named accounts; if the EPR licence does not allow concurrent sessions, use fast user switching so the previous clinician locks rather than logs off. Second, deploy a badge tap plus PIN at the Windows session, with a two-to-three-minute lock and no credential caching on shared devices; measure whether this stays under five seconds at handover. Third, run a two-ward pilot and collect login time, failed logins and observed sharing.
Policy alone will not work, so combine it with detection: alert on the same account used at two workstations simultaneously, on logins from unusual wards, and on access outside the clinician's assigned patients. Give ward managers a simple audit report. Provide break-glass accounts with strong authentication and automatic alerting for genuine emergencies, rather than forcing staff to borrow a colleague's login.
The hard trade-off is clinical speed versus accountability. If badge tap plus PIN cannot meet the time limit, the fallback is a proximity badge that locks the session on walk-away, not shared passwords. Escalate the EPR vendor deadline; the nine-month federation release should be a contractual milestone with penalties, because the current PIN design is the root cause.