3 ms·
What does Red Hat do to prevent someone from copying backup tapes? Or authorized users from copying data to other servers that aren't audited? Or from databases
by staunch 13y ago
What does Red Hat do to prevent someone from copying backup tapes? Or authorized users from copying data to other servers that aren't audited? Or from databases and repositories via their own protocols?
It's rather unimpressive to claim that you can tell a customer that "your sysadmin had authorized access to all data, so any of it could have been copied".
- rwmj 13y agoCopying the backup tapes to what? Auditing is implemented along with physical measures like ensuring USB ports are glued up and people are searched going into and out of the secure data center (which is air-gapped from the internet). You can't even carry a mobile phone -- there are detectors for the signals they give off. (USB ports / CDs being what failed in the Bradley Manning case)
- staunch 13y agoPhysical security is a joke everywhere. I've worked in 50+ datacenters and I'd bet anyone anywhere that I could sneak a 64GB micro SD card out of any datacenter in the world. No one is doing cavity searches, not even NSA. Getting a "decommissioned" or "test" server out full of data would be trivial in 99.99% of organizations. Theoretically it's trivial to audit sysadmins. In practice it's virtually impossible. Let me know when Red Hat wants to bet money on it.
- stephengillie 13y agoRed Hat doesn't sell physical security. Let me know when ADT wants to bet money on it.
- staunch 13y agoRed Hat doesn't offer a real world solution to the problem of auditing sysadmins. That's entirely my point.
- dedward 13y agoI'm pretty sure I recall hearing the NSA never lets anything leave their facilities intact when decomissioning or otherwise disposing. I've heard a story of brand new very expensive servers (big Sun machines I think) sitting in a loading dock, still on pallettes, having the project cancelled and having them destroyed unused rather than risk data leaving the building.
- staunch 13y agoI'm sure they have great policies. I'm also sure they're regularly not followed or easily bypassed by certain people. Who exactly destroys the servers, for example?
- stephengillie 13y agoIt's the responsibility of a business's owners/executives/officers to physically secure their building and technology. Red Hat and other groups (like Schlage, ADT, and police departments) make tools/services you can use to do this, but it's your responsibility to make sure all of your agents are doing what you want them to do. It's rather embarrassing have your IT supplier tell you "This other person who you trusted with access to all your data may have copied some or all of it -- you should trust your employees more granularly."
- staunch 13y agoWhich sysadmin has access to grant other sysadmins access? What do you do about them?
- stephengillie 13y agoIf it's your system, then only you have access to grant access to others. If you hire a sysadmin to build you a system, you make sure you trust that person, and make sure that person is the only one with access to grant access. If that person lies to you and starts handing out that access, you replace her/him. And if you can't find anyone trustworthy, then you're forced to do this job for yourself.