I have a question about computer operation and system administration. I am concerned that if the two functions...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
are operated by the same person, it may lead to fraud. Our computer operator does end-of-day batch processing, data backup, system mornitoring, server startup/shutdown, etc. If the computer operator is has malicious intentions, he could run the end-of-day batch with the wrong database to his benefit. Or he may start or shutdown the important servers to allow others to hack the systems. If he also performs the duties of a system administrator, he can delete the audit trial from log files to hide what he did. So it's bad, right? I think that these two functions need to be separated. Actually, the system administrator who has the most power in the system, should not be allowed to perform other functions.What's your opinion on this? How do we audit the system administrator (in case he deleted his actions from log files)?
You have raised some very valid concerns. In today's organization, system administrators are taking on a greater role in the security of their systems. In some companies, this is even considered part of their job description. While administrators do need to be secuirty conscious, proper checks and balances need to be implemented to prevent them from being able to perform or assist in intrusions, as well as cover their tracks.
For auditing, you should have your log files written to a central server, such as syslog in a Unix environment. Several enterprise management tools are now available that provide one central logging point. These products also analyze all log files, looking for potential intrusions or questionable activities. You should also have a security staff that continuously audits your systems, looking for differences from a baseline configuration, new services, etc. Host and network IDS systems will also help identify malicious behavior.
For more information on this topic, visit these other SearchSecurity resources:
Best Web Links: Security Policy & Infrastructure
Best Web Links: Career Profiles
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.