3 ms·
There's already a good chunk of effort gone into solving the problem of access to Scary Things for nukes & master crypto keying material, such as the Two Man/No
by shabble 13y ago
There's already a good chunk of effort gone into solving the problem of access to Scary Things for nukes & master crypto keying material, such as the Two Man/No Lone Zone[1] rules.
I'm not sure how well it would translate to things like sysadmin tasks which can't all be pre-scripted checklists, but something like a pair-programming model, combined with a full audit log of actions taken, along with actual independent auditors randomly pulling logs and checking for naughtiness could work.
I dread to think of the bureaucracy overhead involved though - I suspect it would probably end up increasing staff headcount several-fold.
[1] https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule
- revelation 13y agoWith the two-man rule, the two man are the users. They are not the people building and maintaining the hardware switch that implements the two-man rule. Now thats obviously a silly distinction because it was a simple electric circuit, but nowadays everything runs on Linux and real operating systems, and you need people to maintain them continuously.
- shabble 13y agoLots of enterprise setups have complicated RBAC/ACL/audit setups where sysadmins/DBAs are only given the bare minimum permissions necessary to complete their required roles. I seem to recall an article from a while back about Google changing some policies after a sysadmin was found to be accessing private user data, to require additional oversight/signoff, or maybe even active observation. Unfortunately, I can't find the article I saw it in, so I may be mistaken. Technical measures and policies can go some of the way, but I think protecting against a motivated internal attacker with some level of elevated permissions is going to be a tough thing to achieve.