Why do shared devices create more identity risk than standard workstation logins?

Why Shared Devices Raise Identity Risk

Shared devices create a different identity problem than standard workstation logins because the device is not tied to one stable user context. Sessions can remain active after handoff, cached tokens can survive beyond the intended user, and informal credential sharing becomes tempting when access needs to move quickly. That weakens auditability, complicates incident response, and makes it harder to prove who actually performed an action.

Security teams often underestimate how fast this turns into an identity control failure. A workstation login assumes a relatively durable user-to-device relationship; a shared kiosk, dispatch tablet, floor terminal, or lab station does not. Current guidance from the NIST Cybersecurity Framework 2.0 still applies, but the operational reality is that identity assurance must survive rapid turnover, not just initial authentication. NHIMG research on the Ultimate Guide to NHIs shows how broadly identity sprawl and weak lifecycle controls create exposure across environments.

In practice, many security teams discover the real risk only after a shared device has already been used to access something sensitive, rather than through intentional device and session governance.

How the Risk Shows Up in Real Operations

The core issue is not just authentication, but session continuity and attribution. On a standard workstation, the login event, the device, and the user usually align long enough to support accountability. On shared devices, that alignment breaks down. The device may be reused by shift workers, contractors, clinicians, frontline staff, or temporary operators, each with different access needs and different tolerance for friction.

Best practice is evolving toward tighter session handling, stronger device hygiene, and shorter-lived access. That often means pairing MFA with re-authentication at handoff, clearing browser state and local caches, disabling password reuse, and using device-bound or time-bound access paths instead of persistent logins. Where shared devices support sensitive workflows, teams increasingly apply just-in-time access and stronger workload or device identity controls so the session reflects the current task, not the last person who touched the screen.

• Force logout or session invalidation at every handoff.
• Use short TTLs for tokens, cookies, and cached credentials.
• Separate shared device access from administrative access paths.
• Log the user, device, time, and action with enough fidelity for review.

NHIMG guidance in the Top 10 NHI Issues reinforces that lifecycle and revocation discipline matter as much as initial access grant. The same pattern appears in incident analysis such as 52 NHI Breaches Analysis, where stale access and weak revocation are recurring themes. These controls tend to break down in shift-based environments where shared devices must remain continuously available and users trade speed for session hygiene.

Common Edge Cases and Control Tradeoffs

Tighter session controls often increase operational friction, so organisations have to balance accountability against throughput and usability. That tradeoff is real in environments like healthcare, logistics, retail, manufacturing, and field operations, where the next user may need access immediately and cannot wait for a lengthy re-enrolment flow.

One common edge case is the “trusted shared device” that is treated as safer than it is. If local admin rights, browser persistence, or cached secrets are allowed, the device becomes a credential container rather than a neutral access point. Another is single sign-on on a shared terminal, where the SSO layer preserves access longer than the physical handoff would suggest. A third is offline or intermittently connected devices, where revocation and policy updates lag behind user turnover.

There is no universal standard for this yet, but current guidance suggests treating shared devices as high-churn identity environments: minimise standing access, shorten token lifetimes, and require a clean handoff every time. NHIMG’s Why NHI Security Matters Now and Standards sections are useful when organisations need to map these controls into a broader identity governance program. Shared-device controls usually fail when the environment prioritises continuity over cleanup, because the session stays trusted long after the user has gone.

Related resources from NHI Mgmt Group

• Why do shared devices and external partners increase hospital identity risk?
• Why do shared devices create more access risk than personal devices?
• Why do shared credentials create risk on the factory floor?
• When does AI help identity governance, and when does it create new risk?