Question

During a security audit of a financial services firm, the auditor finds that three database administrators all log into production systems using a single shared 'dbadmin' account whose password is stored in a team password vault. Management insists this is efficient and that the vault logs who checked out the credential. Which principle of identity and access management is most fundamentally violated by this arrangement?

Accepted Answer

Accountability, because actions performed in the database cannot be reliably attributed to a specific individual

Answer

Least privilege, because all three administrators receive identical database permissions

Answer

Authentication, because the password vault does not enforce multi-factor authentication

Answer

Separation of duties, because one administrator can both check out and use the credential