One spreadsheet, twelve clients’ keys
One shared spreadsheet held the keys to twelve clients.
(Illustrative scenario, not a real incident)
Many small and mid-sized businesses in Taiwanoutsource their IT.
This eight-person IT service providerlooks after twelve clients.Accounts, computers, networks, cloud services—they handle all of it.
For convenience,every client’s admin credentialswere kept in one shared spreadsheet.Every technician could see them, and use them.
A technician left the company.The provider didn’t change a single password.
A few months later,one client’s email systemshowed an unusual admin login.
The client asked, “Which of you logged in?”
The provider couldn’t say.Everyone had been using the same account.
What you see is a handy spreadsheet.What you don’t seeis twelve clients’ front-door keyshanging on the same key ring.
Break one point,and every client gets hurt together.And with shared accounts,no one can say who did what.
I used to think a locksmith’s most important asset was skill.Later I learnedwhat matters most for a locksmithis not cutting keys carelessly,and remembering whom each one was given to.
One key per person,each to their own job.When someone leaves, change the locks.
Each technician uses their own account, with access only to the clients they serve. On the day someone leaves, rotate every password they touched, and log every login.