IT Employment

Ask something
Discussion Locked

Network Security

0 helpful
10 replies

by Member 32001153

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I want to pose a question for IT staff and managers.

If an IT Manager/Director is not really qualfied to work at the server level with full admin rights, should s/he have them? And I have a follow up question. Should anyone, have full admin rights assigned to their account or should you just use specific Administrative logons when the task requires that level of security?

10 replies

by oldefar

As a general rule, security should be approached at two levels. First, the matter of trust. This is where a company, based on background investigation, assigns a level of access. Consider this the high water mark - access up to a specific level. Second is need. Any individual should have access based on need to have or know, but not above their "high water mark".

Next are checks and balances. This involves seperation between where the security access is applied versus where it is controlled. IT should not be involved in authorizing, implementing, and controlling the security. There should always be at least two seperate departments involved, and these should only meet under a common management at the highest level. Its the same reason auditing is down by outside firms.

So how does this apply to your scenario? The IT Manager/Director would have the security level to be given such access, but not the need.

by Member 32001153

Your reference sounds like a large corporation but what about medium and small corporations and small businesses, mom and pop and the like. You don't have the same corporate infrastructure capacity, man power or time to apply this procedure. Also, I think we're getting away from my original question(s).

1. You answered that one. I have found that a lot of IS/IT Managers/Directors have security rights to their general user account, their password is set to never expire and it's usually about 6 characters or less, like bob001 for January. In very small businesses I find that EVERYONE has administrative rights.

2. Should anyone have admin rights assigned to their general user account or should only administrative accounts be provided to modify security settings?

Let me say that I DO NOT favor having one catch all administrative account. I believe each person that has a need to perform duties with administrative rights should have a separate administrative account apart from their general user account.

I also do not think anyone not qualified to work at certain levels of security should ever have access, this includes any/all forms of management, especially the IT manager. It is a security risk.

I don't work on major parts of my car because I do not want an inexperienced mechanic working on my car.

I disagree that an technically unqualified IT Manager should have any access to any area of the network they are not qualified to work on. The network doesn't belong to them. It belongs to the company. Managers are not hired to support the system. They are hired to manage the people that are qualified to support the system.

I made a mistake and informed my boss once on how to run a vrepair on a Netware volume that had name space support. He called me up early one morning and told me he removed the name space support like I showed him when he ran vrepair and now the system has issues. "Now what do I do?"

He also told me he has a system partition. The server was a Compaq and if you're familiar with Compaq, you'll know what a system partition is. Putting the SmartStart CD into the drive, which DID NOT have a system partition initiated SmartStart to create a 5Mb DOS partition and to start unpacking files to create a system partition. This just wiped out the DOS partition that was already there. It also messed up the location of all of the other partitions and even created a 1 byte partition. He then said he wasn't sure there was a backup in the last 45 days. He also said it was end of year and finance had auditors in and they were 3 days away from finishing. Everything could have been lost. Thirty-six hours later, after all attempts had failed and with no other drives available to try a restore, prior to risking restoring to the production server, I asked for a CD of Norton Utilities and was able to repair the partition table. All that was lost was the original DOS partition and we had the license and drivers backed up on floppy. The Netware partition showed the ending sector at the start of the partition and the starting sector at the end. The Netware partition would never load until that was rectified. We skated by on that one and it is one of the reasons I asked this question but it was not the worst thing he ever did to the network.

I see security risks like these everyday and it answers a lot of questions of why people get compromised by a worm that exploits a vulnerability that had a patch available months or even years earlier. The biggest issue I have with this is that these people still have their jobs.

by jellybeenz

...that he can't have administrative access? I understand that this guy is a loose cannon on the network and it's a pain in the a** to constantly fix stuff he breaks. Not to mention the very real possibility of losing crucial data. But if he is your boss and insists on having admin rights, I don't know that there is anything you can do about it. If you go over his head on this, you may find yourself looking for another job. To CYA, make sure all the servers are backed up nightly. Hide the utility CDs in a locked desk drawer and forget to tell him where they are. At least then he can't access them while you're not there. :-[]

by oldefar

I don't know that I would tackle your issues under a security banner. Sounds to me like there are some business disconnects.

Business objective drives business requirements, business requirements drive technical objectives, and technical objectives drive the technical requirements. Security is defined in the business objectives and business requirements before any technical aspects are addressed.

Ideally, all aspects of your IT infrastructure can be mapped directly through all layers to the business objective. Policy and procedure links as well. Policy is a business requirement, procedure supports it at the technical level.

As for how this applies to small and medium businesses versus large corporations - think of function rather than title. Not only does this make it easier to tell "Joe" he no longer has admin privlidges because it is not required with his functions, it offers a migration path for growth.

by timwalsh

I agree with Oldefar that this is a operational/procedural issue, not a security issue (other than the fact that permissions are involved).

The bottom line in any company should be that as a matter of policy, anyone who is not qualified to perform administrator functions will NOT be granted administrator priviliges. Likewise, anyone who has no requirement to perform administrative functions will be granted administrator privileges.

However, the reality is that you still have a political minefield to step through. Because of the "position of power" that they hold, some managers feel they should be granted administrator privileges "just in case", regardless of the consequences (the sad part being they don't even understand the consequences). Getting these managers to understand why you don't want them to have admin rights is often impossible. You are then left with the options of giving in (in which case you will end up fixing the manager's mistakes, whether he takes resposibility for them or not), or going over his head (in which case you risk losing your job for insubordination at worst, or having a very unfriendly supervisor at best).

As for your follow up question, the answer really depends on the circumstances/ environment. There are pros and cons to both arguments.

The problem with using the Administrator account by all administrators is that you have no auditing capability to figure out which of the numerous administrators screwed up the server in the middle of the night. However, if you have a limited (small) number of techs, and they all trust each other's skills and experience, you might be able to get away with only using the Administrator account.

The problem with assigning full admin rights to the administrator's regiular user account is that they will always be logged on with administrator rights (which itself is not an ideal situation.

A viable alternative might be to create separate accounts with full admin rights for administrators to use when performing administrative functions. Otherwise they would use their standard accounts (with standard user rights) for their day-to-day chores. Then only use the Administrator account when absolutely necessary.

by Member 32001153

Tim...

I don't know what time you wrote your response but my first response in this thread was exactly that. Multiple admin accounts, one for each admin for administrative duties, otherwise, they use the general user account, as everyone else does. The reason is for the one you gave, auditing.

by oldefar

Hold the thought on the security for a moment. You are both absolutely right, but this a solution ahead of the requirements. This is part of the reason for the political minefield. By having a solution ready, you open yourselves up for the ensuing arguments.

What are the business objectives and what are the business requirements that justify the server and the applications or files on it? In the business requirement discussion, keep away from technology at every opportunity. Push it back to what the technology is supporting. The trick is to get the business managers to insist on the very security you want to provide, but as their idea. Same for a robust backup process, disaster recovery, even consistent office environment and no user programs. You can even argue against some of the aspects you really want, but when you do it at the business level they will become adamant about the need.

Now, when you bring in your solution, you have every aspect of it linked to the requirements they determined. Instead of fighting for control, they are feeling good about having finally gotten someone in IT to pay attention.

The approach really does work. If you have a dog at home, try pushing it on its left shoulder. The dog will push back. Move to the right shoulder, and the dog will again push back. Just keep this in mind when dealing with those SOB's at the top.

by Member 32001153

This is an ex-boss and I took away his rights when he infected the network for the 3rd time. I also pulled his computers on the network and I disabled his account. I told him when he was clean, he would be re-enabled.

Yes, I have no problem telling anyone who is not qualified that they are not qualified and therefore do not get admin rights. If the company wants to take that responsibility, fine, but until they write off on it, it won't happen. I could see it in court now, "Yes, that's correct. I was terminated for refusing to allow an unqualified person security access to the company's data. My job description requires that I protect the data to the best of my ability and I was doing my job."

by Member 32001153

I agree with the design but I've never seen it in practice, including hospitals, banks, law firms, accounting firms, etc. I take that back, Apache Corporation required 2 signatures from two different department heads to reboot a print server. Sometimes it took days.

by oldefar

Reading your comments to mine, I get the feeling we are on two different pages. Two signatures to reboot a print server? I cannot imagine the valid business objective and business requirements that would create such a procedure. There has to be legitimate linkage - the business requirements must support the business objectives, the technical objectives must support the business requirements. The most common problem is failing to validate these before putting a solution (design, process, procedure) in place.

I have seen this approach work, but it initially requires support at the highest levels and skill in defining the real business objectives and requirements.

This discussion is closed to new replies.