Great example of performative enterprise security practice that contributes to degraded security posture, I suppose. Best of luck.

What would happen if the director suddenly gets sick or decide not to come to work anymore? A lot of people assume that humans are reliable, they are not.

Exactly: limiting access is fine, lack of contingencies is not.

Some systems and services still only allow for one owner though (I'm not going to name names), which can be a big problem when MFA is mandated. From what the poster I responded to said, I'd be very surprised if that were the case for them though - just slightly daft policy.

This is where tooling like 1Password or Apple Keychain that lets you "share" MFA comes into play.

It doesn't allow sharing SMS, email or proprietary app based MFA.

Email is painfully easy to share. SMS may take some tricks (again, iMessage can be useful here).

Proprietary apps are a pita.

> SMS may take some tricks (again, iMessage can be useful here).

How would iMessage help? Every SMS MFA implementation I've seen only works with phone numbers. If you mean "have a phone in the office hooked up to MFA and sign into iMessage with that phone's Apple account on multiple colleagues' devices", I've tried that. It technically works, but is flaky (Apple's reasons for forwarding-or-not greenbubble SMSes are opaque, and much less reliable than iMessages, though I'm told that improved recently due making things give up on Continuity and fall back to WAN more often). It also slams into the reality that most people want to use the Apple device that's getting the SMS codes with their personal Apple account, which causes friction.

If you need that capability, it's probably both more reliable and cheaper to use a web-controllable phone number (Google Voice & competitors).

One of my first boss called it the bus factor, not sure where the term comes from. What's the minimum number that need to get hit by a bus before it's impossible to keep things running. He used to say "you always have some bus factor, but it should never be one unless you're alone, otherwise you deserve whatever crap is going to rain on you someday".

I've found that to be incredibly true in my career.

If you're optimistic you call it the "vacation or lottery" factor - if Bob wins the lottery tonight, will our shit still work tomorrow?

And if the answer is no, well, then Bob just got Hotel California'd and can check out but can never leave.

Help Bob; help yourself.

We call it the HB3 (Hit By Bus Binder). Aka keep a document containing what to do if someone of your team gets hit by a bus.

My team rotates 1 sacrificial member every week to be on call with prod k8s access. It limits who can just push things to prod at any given time while making sure everyone on the team has experience. If someone is out sick or on vacation we do time trading, it works out for everyone.

Have lived this when a seeming healthy mid-30s man dropped dead. Nightmare.

Implemented a lot of “just in case” policies after that, which seemed obvious but oh well.

Yeah, it happens.

I was fire-wardening at a carol service about 15 years ago (think ~850 year old gothic stone church with thousands of candles spread around on every available flat surface - looked amazing, potentially catastrophic).

I was sat near the back with a bucket of sand under my seat, and a guy sat in the middle of the row just across the aisle from me, who would have been around 40 or so, had a heart attack and died.

No warning, no history, just gone, and leaving a fairly young family behind. It was honestly shocking.

Use the exploit to gain access, then upgrade

Let's hope he didn't go skydiving. Seriously, you need to improve your processes.

where do you work? >:)

With AI agents, I've been using sites/services that are bot friendly and don't require MFA.

Not everything needs hyper security. Heck, I've given AI access to spend money on websites and my only restriction is that the websites limit the daily spend(website side... Although I guess a rogue AI could have changed it... )