Separating the roles of computer operator and systems administrator

are operated by the same person, it may lead to fraud. Our computer operator does end-of-day batch processing, data backup, system mornitoring, server startup/shutdown, etc. If the computer operator is has malicious intentions, he could run the end-of-day batch with the wrong database to his benefit. Or he may start or shutdown the important servers to allow others to hack the systems. If he also performs the duties of a system administrator, he can delete the audit trial from log files to hide what he did. So it's bad, right? I think that these two functions need to be separated. Actually, the system administrator who has the most power in the system, should not be allowed to perform other functions.

For auditing, you should have your log files written to a central server, such as syslog in a Unix environment. Several enterprise management tools are now available that provide one central logging point. These products also analyze all log files, looking for potential intrusions or questionable activities. You should also have a security staff that continuously audits your systems, looking for differences from a baseline configuration, new services, etc. Host and network IDS systems will also help identify malicious behavior.