RE: Requested opinions on Access.
"M. Shirk" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
This is grounds for dismissal or even prosecution (in the government I would say). NIST Guidelines speak to Identification and Authentication. Basically, a "Need to Know basis". Security controls should be in place so separation of duties is possible. They are DBA's and should never have the ROOT password to any unix server. If they need admin privileges for certain binaries or scripts, grant them "Only what they Need", and nothing more. However, if you have no security policy, they are free to do as they please. This is even the case if today you go and install security controls like integrity checkers, host based IDS, or any other techniques. There has to be a policy to hold individuals accountable for their actions. Shirkdog. _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions