Smart alternatives to password sharing

You don't have to give away the keys to the kingdom: Smart alternatives to password sharing

Passwords are like keys, used to unlock doors that open to hidden treasures. Consider the passwords you have and why. What do they unlock?

When you were given your password and the access it provided to Brown's information network, it was in support of your education and/or work duties. Your password is a symbol of the trust placed in you to act in a responsible manner when using Brown's facilities. In return, you are expected to practice "smart computing", which not only means that you avoid Internet scams and use anti-virus and anti-spyware to secure your computer, but that you also follow the most basic of the "smart computing" principles of not sharing your password – with anyone.

The truth is, sharing your password isn't smart, and doing so could place Brown as well as you at risk. Besides the University's policy against password sharing, there are numerous federal and local regulations and policies regarding access to confidential information. Sharing a password may mean sharing access to that data, and as a result, you as well as the University may be held liable (criminally and/or civilly) for this negligence.

In addition, your password is also a key to your personal information, and protecting it is perhaps the smartest thing you could do to protect your privacy. Think of it like sharing your banking information. Would you give someone else your bank account or credit card number? Not a smart thing to do, and neither is sharing your password.

The good news is that there are smart alternatives to sharing one's password. The following is a list of commonly given reasons for sharing a password along with ISG's recommended alternatives and instructions.

  1. My Colleague/Supervisor receives many emails which require a quick response, even when he/she is out.
  2. I need to be able to view and update my boss's calendar.
  3. I need access to my supervisor's email.
  4. I need to access another's private folder on a network share.
  5. I need access to another's private folder on a local PC or Mac.
  6. I need emergency access to WebLedgers, COEUS, Banner, etc.
  7. I need emergency access to an employee's email who is ill/unavailable/terminated, etc.
  8. I need to update the MyCourse site for the professor I support.
  9. A temp will fill in the next two months for someone on leave, so we'll give him the username and password of the on-leave staff member.
  10. An outside vendor will need network access for three days to provide training to our department. I plan to share my username and password since it's such a short time.
  11. My Colleague/Supervisor gave me permission to use her password.
  12. My boss wants me to keep the software updated on her computer.
  13. I support a Brown faculty member, but I am not a Brown employee and don't have a Brown account.
  14. [Biomed only] My boss, a faculty member, wants me to approve LeaveTracker (time and attendance) entries for his lab staff on his behalf.
1. Reason for Sharing: My Colleague/Supervisor receives many emails which require a quick response, even when he/she is out.
Recommended Solution: Create a Google shared account which multiple office staff can access (such as isg@brown.edu). Publicize this address as your office's preferred contact on your website, signature blocks, letterhead, etc.
Related Document: Request form available from the Accounts & Access page. Direct link: Submit an Access Request
2. Reason for Sharing: I need to be able to view and update my boss's calendar.
Recommended Solution: Have your boss configure her/his calendar for sharing. (Google Calendar > My Calendar Settings > Shared:Edit settings > Share with specific people)
Related Documents: GoogleApps@Brown Help Site: Changing Calendar Permissions
3. Reason for Sharing: I need access to my supervisor's email.
Recommended Solution: Have your supervisor delegate access to her/his email account. (Google Mail > Settings > Accounts > Grant access to your account)
4. Reason for Sharing: I need to access another's private folder on a network share.
Recommended Solution: Request access to the folder. Depending on the circumstances, contact the office of Computing Accounts and Passwords (CAP) to request access to the relevant centralized file folder (Department File Services) container, your Departmental Computing Coordinator (DCC) for access to a folder on a local server, or if Biomed, contact the Office of Biomed Computer Services.
Related Document: Department File Services. See also, GoogleApps@Brown Help Site: Google Docs Best Practices for details on sharing Google docs as an alternative.
5. Reason for Sharing: I need access to another's private folder on a local PC or Mac.
Recommended Solution: Move the critical files to a shared area folder restricted to you and the owner. See the advice in #4 above for assistance.
Related Document: See GoogleApps@Brown Help Site: Google Docs Best Practices for details on sharing Google docs.
6. Reason for Sharing: I need emergency access to WebLedgers, COEUS, Banner, etc.
Recommended Solution: Plan ahead. Fill out appropriate forms now to get the access you need.
Related Documents: CAP's Form page (note that most forms can now be completed online)
7. Reason for Sharing: I need emergency access to an employee's email who is ill/unavailable/terminated, etc.
Recommended Solution: Review CIS's "Procedures for Emergency Account and Information Access" for instructions.
Related Document: Procedures for Emergency Account and Information Access
8. Reason for Sharing: I need to update the Canvas site for the professor I support.
Recommended Solution: Request that the faculty member make you a "Teaching Assistant" on the course site.
Related Documents: Teaching with Technology documentation (TA and COurse Designer Roles & Permissions)
9. Reason for Sharing: A temp will fill in the next two months for someone on leave, so we'll give him the username and password of the on-leave staff member.
Recommended Solution: Complete a Brown Card ID request form, indicating the need for electronic services. See the instructions above (#2 through #5) for setting up the temp's access to calendars, email, or file shares.
Related Document: Brown Card ID Request form (same form used for visiting faculty, scholars, etc.)
10. Reason for Sharing: An outside vendor will need network access for three days to provide training to our department. I plan to share my username and password since it's such a short time.
Recommended Solution: Request a Guest ID.
Related Document: Visit the Brown University // Guest ID web page for details, including how to become authorized to create and manage guest accounts.
11. Reason for Sharing: My Colleague/Supervisor gave me permission to use her password.
Recommended Solution: Determine why she wants you to have her password. Then, see the instructions above (#2 through #5) to obtain delegate access as needed to her email, calendar, or other services.
12. Reason for Sharing: My boss wants me to keep the software updated on her computer.
Recommended Solution: With your boss's permission, arrange to get a "local administrator" account on her computer. (Make sure she understands this will give you access to any documents or data she stored there.) For help with this, contact the CIS Help Desk (help@brown.edu or 3-HELP) or your department's DCC.
13. Reason for Sharing: I support a Brown faculty member, but I am not a Brown employee and don't have a Brown account.
Recommended Solution: Complete a Brown Card ID request form, indicating the need for electronic services. Then, become an email or calendar delegate, or obtain access to a network file share, as described above.
Related Document: Brown Card ID Request form
14. Reason for Sharing: [Biomed only] My boss, a faculty member, wants me to approve LeaveTracker (time and attendance) entries for his lab staff on his behalf.
Recommended Solution: Contact Biomed Human Resources to obtain delegate access to LeaveTracker.

If you have some specific questions regarding the sharing of passwords or anything on this page please contact the Information Security Group.  We are happy to help you protect your privacy!

Other Helpful Documents

Time to change your Password? Secure IT! article "New Year, New Password"
Tips on creating a strong password
Brown's Computing Password Policy (see Section 3.0 #8)

Visual reminders to post in your office or dorms are shown below.