Realistically, I think there are always people at any organization who could do this—anyone with access to monitoring, alerts, and logs, for example, will be ab

Realistically, I think there are always people at any organization who could do this—anyone with access to monitoring, alerts, and logs, for example, will be able to make undetected changes. Sure, you can put alerts on your alerts and monitor your monitoring, but you need people to manage that second layer too. And no matter how tightly you restrict access, you’ll need people to manage access control.