Technology Nightmare for the City of San Francisco: How to Protect Your Network from the Threat of Rogue IT Employees - Par Rick Cook sur CIO.com.

Unfortunately in the Childs case, many of those principles were apparently ignored. Reports of the incident indicate that while the city was routinely logging administrative activity on the network, they failed to act quickly and decisively when they found the first signs of Childs' activities.

Best practice in these situations is to immediately deny access to the system pending a review. For example, the Nuclear Regulatory Commission's rules for nuclear power plants require that access to important systems be immediately revoked if any suspicious activity is detected.

Another problem is that the city apparently did not effectively apply the principle of least privilege. A network administrator obviously needs wide-ranging access to the system being administered, but that is not the same as unquestioned, unrestricted access. Childs apparently had the ability to create a super password and alter other administrator's privileges at will. While his activities were logged, logging amounts to locking the barn door after the horse is stolen.

In theory, employees at any level should be granted only those privileges absolutely needed to do their job. Since this requires a separate set of privileges for everyone but the lowest ranking employees, this is usually impractical. As a result we tend to assign employees to groups with the same privilege levels, whether that specific employee needs all those specific privileges or not.

The key to making this effective is granularity. For access to some critical functions-like changing administrative privileges-the granularity should be very fine indeed. Since relatively few people in the organization have or need such access to those critical functions, this is much easier to manage.

"For an organization of any size, say the government of a city of a million people, you really need to get serious about how you manage privileges," Laird says.

. Web-profils.com, la place de marché du conseil et de l'ingénierie