Oversight for positions with trusted access

By: Dr. Gene Lloyd

How do you effectively manage employees in technical positions that have the ability to destroy your company with a few strokes of a keyboard? Have you ever wondered about the disastrous effects a disgruntled system administrator or cyber security technician could have on, not just your network infrastructure, but your entire company?

People filling these types of positions are given a lot of power and responsibility that does not typically include any serious oversight. A good system administrator could easily gain access to any files they want and cover their tracks in the process. Who watches the person watching everyone else? Who keeps that person accountable? Who keeps the system administrator from changing all the passwords before quitting (yes, I have seen this happen)? It doesn’t take a great imagination to see the potential harm that can be done by someone with this level of access (well call this “trusted access”). But there are some simple methods you could put into place that creates a level of peer oversight for these types of positions:

Rotating positions – all employees with trusted access should be trained in 2 or 3 different positions and rotate through those positions each week. This will greatly increase the likelihood of discovering any one employee’s attempts at conducting long-term surreptitious actions. This method has the added bonus of more easily being able to cover gaps in schedules during vacations or other long-term absences.

Sensitive action integrity – all actions deemed highly sensitive should only be conducted when 2 employees are present at the same time. Technical controls can be put in place to keep these actions from being conducted by a single individual. In the military we have concepts known as two-person integrity and two-person control that have similar requirements when handling highly sensitive materials.

No one wants someone else looking over their shoulder when they are trying to do their job, but positions that pay as much as these do, and include access to pretty much everything on the network, need to have a greater level of oversight. It might sound intense at first, but it actually makes perfect sense when you consider the negative possibilities. If you would like help determining how to put something like this in place, or which positions should be included, we can give you the advice you need. Sign up below for access to our free video about saving time, money, and resources in cyber security and to schedule a free cyber security consultation with a proven expert in the field.

 

​Sign up for a FREE consultation

​Get a free 1-hour telephone consultation with a cyber security expert with no required commitments -- a $500 value!