3 ms·
Well, for one thing, if you can't ensure that a given privileged person can be locked out of your systems quickly, you have a problem to fix. This should be a 1
by __jal 9y ago
Well, for one thing, if you can't ensure that a given privileged person can be locked out of your systems quickly, you have a problem to fix. This should be a 1-minute operation.
Note that I don't know the details and am making assumptions that may be wrong about the case in question, but in general, if you can't deny access quickly to any given account, you really want to fix that. Not just because of rogue ex-employees - what happens when $important_person's account is compromised?
- ars 9y ago> This should be a 1-minute operation. No. It's easy to revoke access to a user. An admin is different - an admin can install whatever he wants to give him backdoor access. Or a timebomb.
- __jal 9y agoYes, but backdoors/malware are a different question. I was talking about authorized access - LDAP, ssh keys, etc. Detecting unauthorized software from a rogue privileged user is a different problem with very different mitigations. It is a great topic that I'm personally interested in, given that I'm implementing controls for that, but I wasn't discussing that.