The limits of changing shared passwords every time someone leaves

Changing a shared account’s password when someone leaves is the only way to cut off a person who knows it. The limits are the work of sending it out again, and the accounts you miss when no list shows who knows each password.

Why the password changes at each departure

A password works by proving that you know something. There’s no way to make a person stop knowing it. The only way to stop them from signing in is to change the password itself. With a personal account, you disable that person’s account and you’re done. A shared account can’t be disabled, because the people who stay still use it. So the password change is what cuts off the person who left.

US security frameworks ask for this step. NIST SP 800-53 Rev. 5 is a catalog of security controls, mandatory for federal information systems and open to other organizations on a voluntary basis. Its account management control, AC-2, includes item k. It asks for a set process to change the passwords and other sign-in secrets of shared or group accounts “when individuals are removed from the group.” The control’s discussion says the change is meant to ensure that former group members don’t keep access to the shared account. AC-2 l asks you to align account management with personnel termination and transfer.

CISA’s Cross-Sector Cybersecurity Performance Goals cover departures more broadly. Goal 3.D asks for a defined and enforced process to offboard staff, including contractors and vendors. That process covers returning badges and revoking all access to systems. The CIS Controls, from the Center for Internet Security, set a similar safeguard. Safeguard 6.2 asks for a process to revoke access, disabling accounts when a person leaves, loses rights or changes roles. For a shared account, changing the password is how you revoke access.

This change is different from changing passwords on a schedule. NIST SP 800-63B-4, NIST’s guidelines for checking passwords and other sign-in methods, says services “SHALL NOT require subscribers to change passwords periodically” (section 3.1.1.2). The same item says they shall force a change when there is evidence of compromise. A person who left and still knows the password isn’t named in that item. AC-2 k is the text that covers this case directly.

The work behind one change

Most of the work comes after the change itself. In order:

1. Check where two-step verification codes go. If they go to the departing person’s phone or number, move them first, or the people who stay can’t get in.
2. Change the password on the service. This is what makes the departing person’s knowledge useless.
3. Send the new password to everyone who stays. From the change until they all have it, nobody else can sign in.
4. Update every place the password is saved. Browsers, password managers, and tools set up to sign in on your behalf, such as a social media scheduler, still hold the old one.
5. Record when it changed, who changed it, and why. Next time, you’ll need to reach the same people and the same saved copies.

Steps 3 and 4 grow with the number of people and the number of saved copies. Step 1 comes up only when the departing person’s phone received the codes. If you change the password before moving them, nobody may be able to sign in afterward. What is two-step verification? explains why a code can end up tied to one phone.

Where accounts get missed

Accounts get missed when there’s no list. Without a record of who knows each password, you can’t see which accounts a departing person knew on their last day. Asking them won’t always work either. A login someone was given once, years ago, is easy to forget.

Even with a list, departures aren’t the only trigger. People who move to another team, contractors and temps whose contracts end, and anyone who covered for a coworker on leave all still know the password. AC-2 l names transfers next to terminations, and CISA’s goal includes contractors and vendors. If only departures trigger a change, everyone else who stops needing the account is missed.

How you send the new password can set up the next miss. A password sent by chat or email stays in that message, on each person’s devices and in the service’s history. When the next person leaves, you won’t know where all those copies are. Each round leaves as many people knowing the password as before, and more places that hold it.

There’s also the gap before the change. From the day someone gives notice until the password changes, they can still sign in. If you batch changes at the end of the month, that gap can run a full month.

Two ways to need fewer changes

Changing passwords less often doesn’t help. As long as people know a password, the same work repeats. To stop changing at every departure, stop creating people who know it. There are two ways.

1. Split into personal accounts. When someone leaves, you disable their own account and there’s no shared password. This works only where the service lets you add users. A company social media profile, or anything else that exists once, stays shared.
2. Switch to a method that doesn’t reveal the password. Only admins hold it, and people sign in through a tool that enters it for them. When someone leaves, you remove them from the people allowed to use it. Each method has its own conditions on people and devices, and the admins who know the password remain.

Sharing through a password manager sits between the two. It tidies how passwords are stored and handed out. But it can’t make anyone forget a password they saw, so the change at each departure stays. What is a password manager? explains why. Split the accounts you can, then use a method that doesn’t reveal the password for the shared accounts that remain. That order cuts the most changes. Managing shared accounts compares the methods in a table.

What to decide while you still change passwords

Until you move to another method, the changes continue. Settle three things first to cut down on missed accounts.

1. Keep a “who knows the password” column in your list. Each time you send a new password, write down who got it. At the next departure, that column tells you which accounts to change. How to take inventory of shared accounts covers the rest of the list.
2. Use more triggers than departures. Run the same steps when someone transfers, a contract ends, or a period of covering for someone ends.
3. Use a single channel to hand out passwords. Don’t put them in the body of a chat message or email. Use a method that leaves no copy in messages or on devices, and lets you narrow access later. Even then, a password someone knows can’t be taken back, so the change at each departure remains.