Networks

Ask something
Discussion Locked

Delegation,security and responsibility best practices

0 helpful
3 replies

by syadm 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

Consider the following scenario:
Your organization manages a complete IT-infrastructure, Networks, Services, servers & clients, software, security (the whole shebang) for a big customer.

The customer has delegated the responsibility for the IT-infrastructure to your organization and this includes SLA agreements(with penalties) towards the customer.

What would you say if one of your customer representatives demanded to have the topmost administrative access to all resources, free to share with anyone he likes? (The customer rep. is not an IT-pro).

If you say yes, would you still feel comfortable having the responsibility for the environment while a customer rep. is out there and might be sharing his Admin/root access with his colleagues?

If you say no, how would you make the customer rep. understand your point. Would you "renounce" the security responsibility in this case?

Should the responsible alone be root?
Is it possible to share this responsibilities over organizations?
What do you think is the best practice in such cases?

Please elaborate!

BR
/ Tom

3 replies

by jaqui

That stipulation is a deal breaker.
No-one has system admin access unless it is required to do their jobs.
No-one has the right to hand such access out to anyone at will.
anything that breaks the above two points is a complete breach of security, and voids any possibility of doing business.

edit to add:
I'm not saying that the system admin access is completely gone from their company, but it is completely controlled.

by tig2

In that situation, I would escalate over the rep's head and I would do it as quickly as I could.

Then I would be re-visiting the SLAs. I would be setting boundaries of responsibility. And I would be communicating these new boundaries- "You have root access to the system, therefore the penalties are no longer valid as we now have to investigate each and every case to insure that you did not cause the problem."

I'd also be trying to determine WHY the rep thinks he needs "God" access to the systems. Can his needs be met another way? Does his boss also think that he needs this access? How about the CEO?

The contract was initiated because this company did not want to have that work on their plates. But often in arrangements like this, there is a perceived loss of control. Are you dealing with a real need? Or are you managing a perception?

Regardless, if the company is going to insist that they have that level of access, you do not want any part of this arrangement. It is a set up to failure. Just say no.

by syadm

Yes, i am probably managing a perception here, not a real need as the customer has no use for the administrative rights.
(i?ve missed that aspect, thanks!)
It is probably a feeling of shortcoming that generated this demand for "control", nevertheless i might have to meet that demand. I will definitely need a separate security agreement(& SLA) before that.
Thanks for your input.

/ Tom

This discussion is closed to new replies.