Don't Share Passwords

It's always been important not to share passwords, but as we store more and more university and county (and personal) business on line it becomes paramount.  There are many many ways to share information--file sharing in CyBox, your county shared drive, copying appropriate people on emails, but sharing your password should never be one of them.

What if my supervisor says I have to?

University and county employees are bound by university policies, specifically computer ethics and privacy policies.  University policy states:

Eligible individuals are provided access in order to support their studies, instruction, duties as employees, official business with the university, and other university-sanctioned activities. Individuals may not share with or transfer to others their university accounts including network IDs, passwords, or other access codes that allow them to gain access to university information technology resources.

http://www.policy.iastate.edu/ITacceptableuse

Your supervisor does NOT have the right to your password.

But what if the person leaves?

If it's a planned departure...

Work with the individual who'll be leaving to put important information in an accessible location.  We (EIT) recommend CyBox (iastate.box.com).  The person leaving can put the information in a folder and share it only with the people who will need that information.  If different people need different information, make multiple folders and share only with those who need it..

NOTE: if you're saving files in Cybox, it's important to change the folder Owner before the person's last day.  To do this: add the new owner to the folder as a Co-Owner or Editor.  Once they're added to the folder, change their collaborator status to Owner.  If you need help, contact the Computer support hotline at 515-294-1725 and they can walk through it with you.

If it's an unplanned departure or you forgot to transfer something important...

The university has a process for obtaining access to information in the case of an employee who leaves abruptly or is suddenly unavailable.

The process requires a written request to HR and is not something to be used except in very specific circumstances.  It's better to do emergency planning with your office so if the unexpected happens, you have access to critical information.

What about other accounts (Facebook, Twitter, etc)

Greg Wallace, Social Media Coordinator for ISUEO, suggests creating a master email list with more than one person in your office included.  This means that even if someone is out of the office, you can maintain or regain access to your Facebook, Twitter, and other social media accounts.

https://my.extension.iastate.edu/setting-master-email-lists

Category: