4 ms·
I’ve not seen this approach, but it’s definitely an interesting one. What do you do about the people who actually need production access?
by jon-wood 8y ago
I’ve not seen this approach, but it’s definitely an interesting one. What do you do about the people who actually need production access?
- dogma1138 8y agoOrganizations that take security seriously use PAWs for production access. https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations https://docs.microsoft.com/en-us/windows-server/identity/sec... Example of an actual implementation in the wild: https://uit.stanford.edu/service/paw https://uit.stanford.edu/service/paw
- mseebach 8y agoWell, bias towards "infrastructure as code" and minimise the need to actually access the servers. Read logs through Splunk, configure through version controlled Puppet (or similar tools). The only machines that can actually SSH into prod at least have screen-session-recording software, perhaps are kept in a separate room, with a policy of two staff present at all times. The general idea is that the closer you actually get to being able to bypass the checks and controls, the more attention you bring to yourself and your errand. Yes, it can't be Git and Puppet all the way down, at some point someone will necessarily have access to do something as root on the server that hosts the Git repo that Puppet runs from. But instead of that being every dev on every laptop anywhere in the world, you can make sure it's a very small group of people, from a small number of workstations. This is difficult and requires a substantial and very competent team to implement correctly.