Exercise 1: Why Individual Accounts Are a Prerequisite — Possible Solution
====================================================================

A shared account's audit log records the SAME identity — "admin," or
whatever the shared login is called — for every action taken by every
person or service that ever used it. The log technically records that
"admin ran DELETE FROM orders WHERE id=55 at 3:14am," but it cannot
tell you WHICH of the five people (or scripts, or services) sharing
that login actually ran it.

SPECIFICALLY WHAT IT FAILS TO TELL YOU: who to ask about a suspicious
or destructive action, who to hold accountable for a mistake, and
whether an action was performed by a legitimate team member at all
versus an attacker who obtained the shared credential. In an
incident, this collapses the investigation almost immediately — the
log narrows the field to "someone who had the shared password," which,
by definition, includes every legitimate user AND anyone who ever
obtained that one password through any means.

This is exactly why individual accounts (Chapter 2) have to exist
BEFORE auditing can add real value: auditing's entire purpose is
answering "who did this," and a shared account structurally destroys
the ability to answer that question no matter how detailed or
long-retained the logs themselves are.