|
Posted by Leythos on February 21, 2008, 11:48 am
Please log in for more thread options In article <1a3d0a6f-760d-4fbd-b134-cad4303349c3
@z17g2000hsg.googlegroups.com>, david.mowers@gmail.com says...
> > In article <7a2dcc1d-2c71-4e9a-a6c3-1b2514b2fdb6@
> > 71g2000hse.googlegroups.com>, david.mow...@gmail.com says...
> >
> > > Through a combination of setting the
> > > correct policy (no access for admins) and then monitoring the systems
> > > so that the policy does not change, you can achieve the desired
> > > compliance level for your systems.
> >
> > Actually, that does not meet the requirement - the requirement was to
> > block access by Admins to a share/file/folder/etc...
> >
> > It can not be done.
> >
> > Yes, you can provide a log that the violation has happened, but you can
> > not stop it.
> >
>=20
> I don't think that you are accurately representing the problem and/or
> possible solutions. Given that there are fundamental issues with
> keeping an admin from doing anything on his box, this does not mean
> that there aren't things you can do to make a system more secure or
> more compliant. Doing something is almost always better from both a
> security and compliance perspective then doing nothing at all.
> Compliance inspections are never binary in either their goals or their
> results. Since no system is ever completely protected no company would
> ever pass a security audit if the requirement was to provide bullet
> proof security.
>=20
> In summary, adding systems that provide monitoring and policy
> enforcement will definitely tend to make an organization more likely
> to be found "in compliance" then doing nothing at all.
>=20
> This is, of course, the view of a system implementor. If there are
> compliance folks out there who would like to comment, their
> contributions would be welcome.
Dave, I work for many clients, and many of them have to provide SOX or=20
other compliance proof.
The simple fact is that no matter how you dice it up, if you have domain=20
admin access you have access to everything and there is no way to change=20
that.
Yes, logging can show that an admin violated security, but that doesn't=20
change the specifics - the admin has access to anything they want access=20
to, period.
Your Usenet client is broken, it's not properly clipping signature lines=20
when you reply.
--=20
Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a=20
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)
| 
XML Sitemap