Why is having a shared user account a bad practice?

Answer 1

From an accountability standpoint you should have individual user accounts instead of a shared account. If someone breaks something or does something that could be a breach of trust, the law etc you could not definitively state which of them had used the account. You might be able to pin an access back to a workstation etc but if that workstation were not secured then the person could just as easily claim that someone else must have used their workstation to execute said activity.

You should also make sure that their passwords are changed regularly, aren't shared between the technicians etc - not much point having individual accounts if people know each others passwords.

At my organisation the default accounts are renamed and changed to a complex password which must be 'checked out' and checked in if they are used (and there has to be a good reason for that (we have audit process that reports on any use of the default administrative accounts via interactive sessions etc.)