Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

IT Security Pros are very smart people who need to give your environment with the respect and care that the business requires.

Part 1

  • What are the traits you look for in an employee before approving them for sensitive access (root passwords, domain admin, etc)?

  • What warning signs do you look out for that may give you concern?

This person we're talking about can be anyone from an internal employee, an external auditor, or even a vendor /3rd party who you do business with.

Part 2

  • Does any of this change if the person in question has unique skills that no-one (including yourself) has, and may have the ability to outsmart any auditors that may be watching?
share|improve this question
add comment

2 Answers 2

up vote 6 down vote accepted

Employee security clearance is a major issue for organisations, and even more so in positions of sensitivity such as admin, root or super-user roles. My usual thumb, is to assume that these roles can do much more damage than a normal user so heavily protect your organisation from them. Traits may be the wrong word though - as many traits of highly skilled professionals are the same as highly skilled criminals.

In some countries this is easier than others, but basic security clearances include credit and criminal checks (if an individual is heavily in debt they become more amenable to persuasion from criminal elements, and a criminal history should rule out individuals for sensitive roles, especially if it was a crime associated with IT fraud.) Known associates should also be researched.

For highly sensitive roles, regular rechecks may be required. And an awareness of your employees behaviour could be a value add! Salaries should also be reviewed - underpaid roles are a straightforward target for bribery and corruption.

This doesn't really change if the individuals has unique skills, as underlying the roles should be an infrastructure which prevents misuse, for example restricting administrative rights to only those required should be a given. For most platforms, root or Administrator access is not required, so where relevant a Power User or lower should be used, and root should be restricted to emergency occasions - where it requires input from two individuals:

an example:

Database admins often demand full superuser rights, but this is almost never needed. There are many types of admin role which can be assigned as appropriate, and root can be a break-glass role which requires retrieval of a password from a safe, or from two individuals each holding half.

To summarise - yes, IT gurus are essential but dangerous; protect yourself from them with technical and procedural controls, research their background and use their skills to add value.

share|improve this answer
2  
Basic background checks are a must for high security roles. Frankly they should be required for most roles in IT (IMO). –  Steve Dec 2 '10 at 0:49
    
Yeah - IT underpins pretty much everything a business relies on these days, including the financials. Fraud in this area is huge business! –  Rory Alsop Dec 2 '10 at 11:36
add comment

At a minimum background checks. After that I look for instances where they needed to make difficult choices, specifically looking at how they handle authority and power. Since I don't have an interest in micro managing someone I need someone that isn't going to try and be Napoleon.

If someone makes a lot of excuses I would start to get concerned. I want someone that will own up to mistakes they make and move the conversation forward. None of my views would change it the person had unique skills since we're not afraid to train people. It's common for us to send someone to training for certification with our EMR (electronic medical record) right after they started.

share|improve this answer
    
Linked with this is how they behave under pressure, but you will usually only find this out when it happens... –  Rory Alsop Dec 2 '10 at 20:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.