Manage, monitor and audit privileged (sysadmin) users in a distributed systems environment

Abstract

The recent spate of legislation in both the Americas and Europe, such as Sarbanes-Oxley and the European Directives, has made compliance a big issue for publicly listed companies. In certain cases such legislation also affects privately held companies who conduct business with the listed sector. The essential requirement of the legislation is to protect the integrity of the financial information that is provided to the public, or at least to show due diligence in attempting to protect it. It is difficult to prove this when privileged users, typically administrators, have unlimited access rights to critical IT systems.

This white paper describes a method of ensuring that the use of privileged accounts is reduced to the absolute minimum by:

• encapsulating the majority of privileged routines in menu/forms driven procedures
• enforcing administrators to request privileged sessions on particular systems for particular periods of time
• allocating only that subset of commands required to carry out a requested function
• auditing all activity and reporting on those audit trails

There is a major commercial benefit in that encapsulated routines can be delegated in a controlled, audited manner to less technically aware staff to perform.

Abstract

Too often, end user organisations spend large sums of money on contracted, skilled systems administration staff only to find that the knowledge they bring to the site disappears with the contractors when they leave.

This white paper describes a method of encapsulating that knowledge in software so that best practice, developed during their stay, continues to be carried out after they leave. Of equal importance is that the resultant encapsulated procedures may be subsequently carried out by relatively unskilled personnel, with full auditing and control of their activities.

The result is:

• the encapsulation of procedures to ensure best practice and policy enforcement
• the reduction in dependence on skilled systems administrators
• the reduction in operations costs by delegation of complex procedures to less skilled personnel
• the reduction in operational errors due to enforced standards
• greater job satisfaction for skilled technicians who are released from routine housekeeping tasks
• service level accountability through auditing of all duties
• improved security

  Table of contents (both)

  Other visitors are downloading . .

Introduction

The problem

Step 1 – Removing the need for command line access

The OSM Toolset

Delegating the procedures

Check the procedures have been carried out

Step 2 – Secure the use of 'root'

Summary

About the author

Other papers by the same author

Obtaining more information

w A CIO's guide to User Provisioning and the business benefits it brings

w COSuser - an overview of its architecture

w Effective Identity Management by means of a practical and automated user management solution

w A guide for security managers and auditors to the security benefits which can be derived from the implementation of User Provisioning software

w A CIO's guide to the Return on Investment (RoI) achievable through the implementation of User Provisioning

w COSuser and MIIS Integration