PCI DSS requirement 8.5 (and the associated sub-requirements) applies to administrators. As such, administrators are not allowed to share passwordsYes, but use of any shared authentication credentials such as group, shared, or generic IDs (including for administrator accounts such as admin or root) must be prevented unless needed for an exceptional circumstance and must be managed in accordance with all elements of PCI DSS Requirement 8.2.2.
PCI DSS Requirement 8.2.2 applies to all shared authentication credentials, not only those used by administrators. The intent of the PCI DSS requirements for unique user IDs and complex passwords is to ensure each user is uniquely identified—instead of using one ID and password for several employees—so that an organization canstrict management of user identification and accounts (requirements under 8.2) and strong authentication (requirements under 8.3) is to ensure each user is uniquely identified such that every action taken is attributable to an individual user ID. This allows organizations to maintain individual accountability for user actions and provide an effective audit trail per employeeuser ID. This will help speed issue resolution and containment whenif misuse or malicious use occurs.
Often, this requirement for unique IDs and complex passwords is met within administrative functions by using, for example, “su” or SSH such that the administrator initially logs on with their own unique ID and password, and then connects to the administrator account via “su” or SSH. Often direct root logins are disabled to preventFor administrative functions, tools or password vaults can be used to facilitate management, security, and limited use of this shared administrative account. This way, individual accountability and audit trails are maintained. However, even with use of tools such as “su” and SSH, the actual administrator IDs and passwords should also meet PCI DSS requirements (if such accounts are not disabled) to prevent them from being misusedIDs, including confirming the identity of individual users and maintaining individual accountability and audit trails. A password vault is an example of a technology that can be used when a shared ID is needed for emergency use or “break the glass” administrator access.
