5 ms·

I don't think Snowden would have any idea whether the audits were effective or not. An analyst in the position of auditing is likely segregated from the employe

• Spooky23 13y ago
  He may have guidance about the types of things that auditors are looking for. For example, checking out your neighbor, girlfriend or a public person's records for curiosity is probably a big red flag.
• Amadou 13y ago
  I think it is entirely plausible that a sysadmin would know exactly what logs the auditors inspect and that he would know the things like how often the logs were deleted as well as exactly what information is (and is not) captured in the logs. He may even have had access to the same tools the auditors used so that he could run them himself and see what they flagged and didn't flag. It is my experience that systems auditors rely heavily on sysadmins to do their jobs. At a minimum the auditors are "just" another set of users and the sysadmins' responsibilities include supporting the auditors even more closely than they support regular users of classified systems. Frequently the auditors themselves do not have systems-level knowledge of the computers they are auditing. Security on every classified system that I've seen was generally limited to a series of a checklists that some talented specialists once put down in a manual and are left to low-skilled employees to check off each day/week/month - if it isn't specifically on the checklist they have little to no knowledge of it. That includes glaring procedural holes. Essentially security is all CYA, so that everybody involved can say they followed the rules and not lose their job if something goes wrong.