4 ms·
You can set things up so there's no way for any single to bypass logs or other audit controls. A trivial way is to have all logins go via an administration hos
by rdl 13y ago
You can set things up so there's no way for any single to bypass logs or other audit controls. A trivial way is to have all logins go via an administration host which logs separately , and never give admin rights on that machine to people with admin on the protected systems.
- jacquesm 13y agoYep. That's the way to do it. But a surprising number of companies have things set up so that a single individual can get at whatever data he or she wants without any logs or with logs that can be tampered with. Typical reason in small companies: there is only one person with the required skills. What is surprising is that even the NSA did not follow these practices after all if there is a place where such a system would make sense it would be there, and they certainly could not make the excuse that they're small.
- deleted 13y ago[deleted]