5

While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to date with server environments/networks etc). There is one manager in a remote office who "knows what is best" and always "wants to get things done now". The MD has given him approval to have a domain admin account but I'm not sure they realise what the implication of that is.

The manager is not particularly technical and has a fairly rudimentary understanding of IT. Nonetheless, we find him making changes to our environment (resetting passwords, installing new software/applications/servers) and dictating directions (choosing hardware etc) for us. I'm pretty tired of it, and I'd like to present a list of compelling reasons why this shouldn't be allowed.

Primarily we are a security company so as a result, I'd like to focus on the security side of things (that's where my expertise lays so it carries the most weight if I speak to the 'higher ups') but any business reasons would be good to have as well.

Edit:

Okay. So maybe I'm a bit unique in that I personally care if something goes wrong in our environment. I'm personally quite fond of the work I do and the company I work for. But since we are a fairly small company, most people are somewhat involved. If something goes wrong I'm covered, but there will still be fall-out of some kind which would impact the business.

Improve this question
1
  • 1
    Good point from DodgyG below: "Is it within my remit to be worried by this". I would also ask myself: "Am I covered should the worst happen?". If the answer to the first question is 'yes', and for the second question is 'no', then you should definitely try and stop that. So, in view of self-preservation having a higher priority in my list, I would definitely base my decision upon the second question, but bearing in mind the first one too. As for the list, I think you can get some general ones off internet and drill down onto your own context/environment.
    – Lex
    Commented Apr 17, 2013 at 8:03

3 Answers 3

Reset to default
9

Firstly I would answer the question "Is it within my remit to be worried by this". Presumably the sys-admins have a team lead or line manager, and it is their responsibility, not yours. You may be letting emotions cloud judgement a bit.

A good place to start if you want to get involved regardless is to propose some level of change control. Putting all changes to your environment through a change process would at least force the errant manager to justify his changes and decisions.

Improve this answer
1

What I have observed most of the time in such situations is unless this person screw up everything, the management is not going to take any remediation step.

Instead of asking to take a way domain administration privileges from this particular individual, what you can do is ask the management to take away DA from everyone and only if a particular process is followed (for example approval from two persons clearly mentioning why a person wants a DA and for how much time) should DA be assigned to the individuals for a limited period of time and the actions be closely monitored and audited.

This will not only increase the overall security but no one will feel targeted as the same policy will be for everyone.

Improve this answer
0

Give administrative access to nominal accounts as requested and, if your OS allows you to, audit everything that is done using administrative privileges.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .