4 ms·
I would think the first and easiest thing to do to prevent situations like this is to make it so a single person cannot run certain commands. Sort of like the
by typetypetype 10y ago
I would think the first and easiest thing to do to prevent situations like this is to make it so a single person cannot run certain commands. Sort of like the digital version of two keys on the opposite side of the room to launch a missile.
- zzzcpan 10y agoIt's not the kind of problem, that can be solved with technology. There will always be people with access not loyal to the company and pissed at management.
- kefka 10y agoI would disagree. Backups could be maintained on a regular schedule, including full router backups. Others in charge of this could be given create and append access to the backup systems, but not delete. Once you delineate split rights and controls, then you can mitigate the severity of these attacks. Yes, douchebag-router admin can still zero out the routers. But you can be in business in less than a day with those configs logged.
- atmosx 10y agoAnd who's going to design the backup scheme, the management? One more click to erase all backup servers, I mean since we're here... Point in case, as parent commentator said, it's not the kind of problem that you solve with technology.
- joenathan 10y agoDon't need to have the ability to delete, with create and append access one could also just corrupt all the backups.
- typetypetype 10y agoRight - going down for a day can be damaging enough for some companies. Not allowing one person to click the "erase" button in the first place should be the focus. How hard could it be to implement a system where two or more people have to issue a command before it runs?
- st3v3r 10y agoAll that just so you don't have to treat your employees like human beings?
- kefka 10y agoNot at all. If a human can do some damage, so can a script. Giving appropriate accounts permission so that no 1 account can destroy the whole system is just smart. But thanks for assuming I'm some inhumane business exec, or a VC.
- Vintila 10y agoNot completely solvable no, but implementing four-eyes authorisation is a decent measure.
- swalsh 10y agoHonestly, it's not a bad idea even if the only reason is to just prevent accidental execution. In the company I work at, we have something similar for database executions. In Dev you can run anything you want. However in prod, everyone only has read-only access. If you wish to execute something with higher authority, there is a web page we go to, where we can paste the code, a review board request, a ticket number (if available) a business authorizer, and a technical authorizor (other than yourself). It sounds like a lot, but it's usually pretty quick. Every command is then logged (which I believe is more for SOX reasons). It's annoying, but it's not that terrible of a system.
- djrogers 10y agoThat's what it's like from your side of the glass - on the other side there are still sysadmins who either execute those commands, or have access to the API keys privileged to run those commands.
- quantumhobbit 10y agoUntil the person fulfilling those requests goes on vacation. Then you're screwed. Of course a sane company wouldn't have a bus factor of one for such a process, but not all companies are sane.
- marcosdumay 10y agoIt's always the same problem: Who will deploy such a system? At some point, you'll get somebody with full access to your system. You can reduce it into a very small window (at big cost), but you can't make it go away.
- PeterisP 10y agoHave a few people at a single computer perform the following ritual: 1. deploy the system 2. create new admin account with a long random password and/or 2FA physical token 3. print the password out, seal it in an envelope and put it in a safe not accessible to any IT person; place the 2FA token in a separate safe controlled by different person than the first safe; 4. remove all other admin accounts - with the other present technicians checking that no other account will have access 5. if needed, with proper authorisation you can retrieve the password, and implement the required changes (again, with a second person controlling what exactly is being done). If the systems require changes rarely, then this cost isn't that high.
- dingaling 10y agoA while ago I stumbled across a how-to guide to implement smart-card authorisation of sudo commands. Google-fu is failing me now. I assume one could refine the process by binding sets of commands or capabilites to specific cards. Would also be rather handy in preventing remote access attacks.