4 ms·

Honestly this is a terrible idea. Say what you will about their programs, what they don't need to do is CUT DOWN on the Sys Admins, what they need to do is dist

Honestly this is a terrible idea. Say what you will about their programs, what they don't need to do is CUT DOWN on the Sys Admins, what they need to do is distribute access more cleanly so that no one person can take out a big chuck of classified data.

shabble 13y ago
There's already a good chunk of effort gone into solving the problem of access to Scary Things for nukes & master crypto keying material, such as the Two Man/No Lone Zone[1] rules. I'm not sure how well it would translate to things like sysadmin tasks which can't all be pre-scripted checklists, but something like a pair-programming model, combined with a full audit log of actions taken, along with actual independent auditors randomly pulling logs and checking for naughtiness could work. I dread to think of the bureaucracy overhead involved though - I suspect it would probably end up increasing staff headcount several-fold. [1] https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule
- revelation 13y ago
  With the two-man rule, the two man are the users. They are not the people building and maintaining the hardware switch that implements the two-man rule. Now thats obviously a silly distinction because it was a simple electric circuit, but nowadays everything runs on Linux and real operating systems, and you need people to maintain them continuously.
  - shabble 13y ago
    Lots of enterprise setups have complicated RBAC/ACL/audit setups where sysadmins/DBAs are only given the bare minimum permissions necessary to complete their required roles. I seem to recall an article from a while back about Google changing some policies after a sysadmin was found to be accessing private user data, to require additional oversight/signoff, or maybe even active observation. Unfortunately, I can't find the article I saw it in, so I may be mistaken. Technical measures and policies can go some of the way, but I think protecting against a motivated internal attacker with some level of elevated permissions is going to be a tough thing to achieve.
deleted 13y ago
[deleted]

shabble 13y ago

There's already a good chunk of effort gone into solving the problem of access to Scary Things for nukes & master crypto keying material, such as the Two Man/No Lone Zone[1] rules. I'm not sure how well it would translate to things like sysadmin tasks which can't all be pre-scripted checklists, but something like a pair-programming model, combined with a full audit log of actions taken, along with actual independent auditors randomly pulling logs and checking for naughtiness could work. I dread to think of the bureaucracy overhead involved though - I suspect it would probably end up increasing staff headcount several-fold. [1] https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule

revelation 13y ago
With the two-man rule, the two man are the users. They are not the people building and maintaining the hardware switch that implements the two-man rule. Now thats obviously a silly distinction because it was a simple electric circuit, but nowadays everything runs on Linux and real operating systems, and you need people to maintain them continuously.
- shabble 13y ago
  Lots of enterprise setups have complicated RBAC/ACL/audit setups where sysadmins/DBAs are only given the bare minimum permissions necessary to complete their required roles. I seem to recall an article from a while back about Google changing some policies after a sysadmin was found to be accessing private user data, to require additional oversight/signoff, or maybe even active observation. Unfortunately, I can't find the article I saw it in, so I may be mistaken. Technical measures and policies can go some of the way, but I think protecting against a motivated internal attacker with some level of elevated permissions is going to be a tough thing to achieve.

deleted 13y ago

[deleted]