How to Manage Shared Account Risks (Narrative Guide)

A shared account, a term familiar in the digital workspace, is defined by a singular set of login credentials used by multiple individuals within an organization to access specific software or online resources. At first glance, this approach seems practical and cost-effective, promising ease of access and reduced administrative overhead. Yet, this simplicity can be deceptive. Without best practices and ongoing oversight, the convenience of shared accounts can swiftly transform into a costly liability.

The question then arises: How can companies mitigate these inherent risks? The traditional method of appointing someone to oversee such accounts is not always practical. Not only does this add significant expense, potentially outweighing the benefits of shared accounts, but it also introduces the human factor – error-prone and, in rare cases, susceptible to malicious intent. What's needed is a solution that transcends these limitations.

In this blog, we won't just present you with statistics, how-tos, or generic advice. Instead, we invite you on a narrative journey. We're going to unfold a story – a scenario that might be unfolding in a company at this very moment or could emerge in the future. So, brace yourself as we dive into the saga of Acme Company and explore how their story could have been navigated with Resmo. Let’s begin the journey!

Navigating the Perils of Shared Accounts: A Cautionary Story

Acme Company, an emerging star in the online wellness sector, embodies the essence of a small yet impactful organization on a rapid growth trajectory. Specializing in connecting individuals with therapists, meditation gurus, and yoga practitioners, Acme has successfully carved out a niche for itself in the pursuit of mental and spiritual well-being.

In its ascent, Acme, like many growing companies, has had to navigate the delicate balance between cost-cutting and maintaining safe operational practices. This balancing act has led them to leverage over 50 different SaaS tools, aiding in everything from boosting their marketing initiatives to enhancing their development efforts. The digital footprint of Acme, driven by its dynamic marketing, social media, and sales teams, has flourished, propelling the company to notable heights.

The Shared ChatGPT Account That Told All

Shared OpenAI Account

At Acme Company, a vibrant online wellness platform, the marketing team extensively used OpenAI’s ChatGPT to generate creative content and design product pages. This innovative tool, though not dealing with sensitive information, became an integral part of their workflow.

In Acme company, the login credentials especially for shared accounts are casually noted on sticky notes, resting on one of the team member’s table. Simon, the operations and HR manager known for his dedication and meticulous nature, came across these credentials. Curiosity piqued, he decided to explore this tool, unaware of the consequences this act would soon unfold.

Suggested Reading: Best Practices for IT Password Security

As the year-end approached, Simon was busy with analyzing employee performances and preparing feedback and salary increase letters. Eager to deliver high-quality work, he decided to use ChatGPT for reviewing and refining these important documents. Months earlier, he had borrowed the login details from a colleague’s desk, and now, he felt prepared to harness the potential of ChatGPT for this crucial task.

The Unraveling of Confidential Information

However, Simon's well-intentioned use of ChatGPT backfired. Unbeknownst to him, every piece of sensitive information he entered was visible to three other colleagues who shared the same account. This oversight turned into a disaster as confidential data - salaries, performance reviews, and personal feedback - became accessible company-wide. The impact was immediate and catastrophic. The once cohesive team was now embroiled in disputes and discontent, with employees confronting each other over the unveiled information.

Suggested Reading: ChatGPT Security Risks

The Fallout and Brand Reputation Damage

Amidst this internal chaos, the situation escalated as the breach of confidential information extended beyond the company walls. Acme's reputation, particularly concerning data privacy, suffered a severe blow. Customers and potential clients, already sensitive about their personal information, expressed their concerns and fears, aggravating the crisis.

Implementing Resmo: Averting Crisis at Acme Company

The incident at Acme Company vividly demonstrates the risks associated with shared account usage lacking proper oversight. This story isn't advocating for the abandonment of tools like OpenAI or the complete elimination of shared accounts. Instead, it highlights the critical need for robust control mechanisms — a gap that Resmo could have effectively filled.

Having Resmo - Two Alternative Scenarios

Imagine an alternate scenario where, as Simon logs into the shared ChatGPT account, Resmo is already in place and fully operational. The system immediately recognizes this activity and sends a real-time alert to the account administrator. Two potential outcomes could emerge:

1. Admin Authorization with Guidance

Perhaps Meredith as the admin or Barry from IT, opts to authorize Simon's access. However, they promptly advise Simon on security best practices, specifically cautioning against entering sensitive information into the shared account.

2. Access Revocation by Admin

The admin, informed of the unauthorized usage, decides to revoke Simon's access to the OpenAI account, thereby preventing any potential data breach.

In both scenarios, Resmo’s vigilant monitoring and swift response mechanism effectively prevent any confidentiality breach. The sensitive data remains secure, maintaining the trust of the employees and safeguarding the company's integrity.

Leveraging Resmo - How to 

Detect

With just a few steps, log into Resmo and run the Shadow App discovery. This allows Acme company to identify and catalog all the apps being utilized within the company, including user access details and shared accounts.

Manage

Once you have all your stack in one place you’re ready to go. In the Action Center, navigate to the 'Shared Accounts' section. Here, Acme can monitor all shared accounts, set up alerts for new shared account creations, and track access.

Get Notified and Review

Set up notification alerts for shared account access or trigger issue creation for app owners. Additionally, assign review tasks to users for assessing shared account access.

Authorize or Revoke Access

After a thorough review, authorize user access to a shared account if deemed appropriate, ensuring secure and controlled usage. Conversely, if access is inappropriate, revoke it. Resmo will continue to provide real-time updates on new sign-ins and potential vulnerabilities. 

The Acme Company and Simon's story is a compelling illustration of the challenges in digital security. Yet, this is only the half of a two-part journey. Next, we invite you to delve into a different scenario involving Holly, a former employee at Acme. Discover how she leverages the company's weakened reputation to establish her own venture, Acmerium. 

Holly’s Departure: Exploiting Acme’s Vulnerability in Times of Crisis

In the bustling digital landscape of Acme Company, Holly played a pivotal role as the Social Media Manager. Her expertise didn't just boost Acme's digital presence but also gave her access to vital tools like Webflow, a shared account critical for website management within the marketing team.

However, as Holly set out to establish Acmerium, her online wellness venture, she left Acme at a time when the company was reeling from a recent internal crisis. Her offboarding from Acme was marked by a significant oversight. While routine procedures like email and account deactivations were executed, her access to Webflow slipped through the cracks, a direct result of Acme's manual offboarding processes and absence of a comprehensive system to monitor employee access.

Amid Acme's turbulent phase, Holly saw an opportunistic window. Using her active Webflow credentials, which remained unchanged post-departure, she embarked on a covert mission. Her aim was clear yet nefarious: to implant backlinks to Acmerium within Acme's website, stealthily diverting Acme's clientele to her expanding business.

This calculated move was an exploitation of Acme’s vulnerable state. The malicious insertion of Acmerium's backlinks onto Acme's site led to an unintended redirection of visitors, chipping away at Acme's web traffic and further damaging its already shaken brand reputation. The fallout was significant: a loss of customers, a dip in web traffic, and a prolonged recovery from the blow to its public image.

Leveraging Resmo - Preventing the Crisis

In this scenario, a simple implementation of Resmo could have dramatically altered the outcome. Consider this revised sequence of events:

Immediate Offboarding Notifications

As Holly’s departure is initiated, Resmo, fully operational, would have immediately alerted the relevant app owner or the IT department. This alert would signal the necessity to reassess shared account accesses associated with Holly.

Proactive Security Measures

Prompted by Resmo, Barry from IT, or the account owner, would then be reminded to update the Webflow account's password, effectively cutting off Holly’s access.

This strategic intervention by Resmo would not only have secured Acme's digital assets but also prevented Holly from exploiting Acme's vulnerable state for her gain. The story of Holly's departure highlights the critical need for automated and vigilant security systems like Resmo, especially during periods of internal upheaval.

Conclusion - The Shared Account Dilemma and Ensuring Company Integrity

The story of Acme Company, marked by Simon's unintended security lapse and Holly's calculated exploitation of shared accounts, shed light on a crucial aspect of digital security. These narratives illustrate not just the potential threats posed by shared account usage but also the significance of maintaining a company’s security posture and integrity.

Shared accounts, by their very nature, present a complex challenge. They offer practicality in scenarios necessitating team collaboration or role-based access, yet they inherently carry risks to security and accountability. The incidents at Acme Company underscore how shared accounts, when not managed with stringent oversight, can lead to breaches of confidentiality, loss of data integrity, and, as seen with Holly, opportunities for malicious exploitation.

In addressing these challenges, tools like Resmo play a pivotal role. The Shared Accounts page within Resmo Action Center serves as a critical management hub, offering comprehensive oversight of shared accounts across an organization's SaaS platforms. This platform is not just a tool; it’s a safeguard, providing key features and functions vital for maintaining digital security:

Identification of Shared Accounts: Resmo helps in pinpointing which accounts are shared and who has access to them, allowing for better control and oversight.

Monitoring Access to SaaS Applications: Continuous monitoring ensures that any unauthorized or suspicious access is quickly detected and addressed.

Authorization Control: The ability to authorize or unauthorize access to shared accounts empowers companies to maintain strict control over who has access to what data.

Encouraging Secure Practices: Resmo can prompt users to cease sharing accounts unnecessarily, change passwords regularly, and review any security issues.

The conclusion we draw from the experiences of Acme Company is clear: While shared accounts are a reality of modern digital workflows, their management cannot be taken lightly.

Tools like Resmo offer a pathway to not only navigate these challenges but also reinforce the security and integrity of a company's digital infrastructure. By implementing such solutions, organizations can ensure that their collaborative efforts do not compromise their commitment to security and trust.