An IT staff member asked for our shared account password to test a change, and a supervisor gave it to them in plain text. The account is used by several contractors, and the password is not very strong.
Is that a normal request? I'm concerned about accountability if something happens with the account. Should I raise it with our account manager?
I'd raise it with the account manager as a question about the approved process, not as an accusation. Check the employee handbook or security policy too. Ask who can authorize a password change and whether the disclosure should be reported through the normal security channel.
For testing, a user could sign in while IT observes in person or through an approved remote session, without telling IT the password. Admin access doesn't necessarily reproduce every user setting, but that doesn't make password disclosure the only option.
The shared login is the bigger accountability problem. If several people know the same password, an account log generally tells you which account was used, not which person was at the keyboard.
Individual accounts are the cleaner fix. Each person can get only the access needed, and access can be removed when they leave. That takes some administration, especially with frequent turnover, but it gives the logs more meaning.
Shared accounts do exist, even though they aren't ideal. Sometimes cost, staffing or the setup of a system makes changing them harder than it sounds.
If the account has to stay, keep its permissions limited and ask IT about a strong password stored in an approved password manager. Other controls may help establish who was present, but they don't turn a shared login into individual accountability.
I'm with you on questioning the request, but I wouldn't assume it proves anyone meant to do something wrong. Ask what the test required and what the approved way to handle it is. That leaves room for an explanation while still flagging the risk.
Answers are reviewed before publication.
q2!parcel_683:
Worth asking whether the password should be changed, rather than changing it yourself. Other staff may depend on that account.