up vote 3 down vote favorite
1
share [g+] share [fb]

I've got a current problem at work (i'm an IT manager) whereby users are logging into some of our systems using an account which is actually someone elses.

We have to be PCI compliant (you should probably note this).

Most of the internal systems i've sorted (but advise is always welcome on this too).

The current issue relates to an external email campaign system that contains some customer information, users are using a single account that is actually designed for one person.

I believe every user should be logging in with their own username and password regardless of cost.

I need some information to back me up, and wondered just how legal it is to login as someone else to this kind of system?

I would have thought it's not PCI compliant or legal?

link|improve this question
3  
Depends on your country, but I doubt it's illegal anywhere. It's likely a PCI violation (depending on what info they have), and possibly a violation of your contract with the email provider, but those aren't laws. At least in the US, I wouldn't be breaking any laws if I create a "Billy Howard" user account on my laptop and start logging in with that. – Shane Madden Nov 21 '11 at 22:06
I'm not sure creating a different account applies here, these people know for a fact it's not their account and the login is based on email. – Billy Howard Nov 21 '11 at 22:16
The world is a very big place and large parts of it aren't using the same legal system as you. You'd need local legal advice for that. It could potentially be illegal here in the UK. Maybe, I think but then I'm not a lawyer so my thoughts carry little weight. Frankly, almost regardless of legality, this is a policy matter and needs to come from the top level down. Another question would be: Are people using the accounts of other people for convenience or because they simply can't get the job done otherwise? – DJ Pon3 Nov 21 '11 at 22:34
It's convenience and in my mind it's not acceptable - if something goes wrong there's no accountability. – Billy Howard Nov 21 '11 at 22:38
Then it should be possible to change it but that needs to be mandated from the top. You're absolutely right, of course, but its not easy to break people of habits. – DJ Pon3 Nov 22 '11 at 8:20
feedback

closed as off topic by Shane Madden, ErikA, DJ Pon3, voretaq7♦, MDMarra Nov 23 '11 at 23:09

Questions on Server Fault are expected to generally relate to servers, networking, or desktop infrastructure, within the scope defined in the faq.

1 Answer

up vote 4 down vote

It is certainly common to find services out on the internet, where the provider suggests sharing a shared account for an organization, or a unit within the organization. Nothing about that is specifically illegal.

There are some password-wallet systems you could implement withing your own organization, so that the end-user is never given the actual password, instead it would be auto-filled on their behalf by some kind of plugin/agent within their browser.

I hope someone checked to make sure that your usage doesn't violate the TOS of this external email campaign system.

There have been some attempts to convict people for violating a TOS, but the case was overturned on appeal.

Since this system does have PII, it does seem somewhat reasonable to be concerned about security. There are certainly other solutions, that mail list solutions you could choose to use.

link|improve this answer
3  
Thanks - I just checked the TOS it does state the following: "4. Your login may only be used by one person – a single login shared by multiple people is not permitted.". – Billy Howard Nov 21 '11 at 22:32
Then there is your proof. – TylerShads Nov 21 '11 at 22:36
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.