How do you protect against your IT domain admins accessing your data?

Question

I work at a small company and we use an external company to take care of all our IT needs (a "managed IT service provider"). This includes managing our windows domain, our network, and everything else. To do so, they obviously have domain admin rights over all the computers.

Some high-profile employees work with sensitive files and data that we need to be sure no one is able to access or steal.

How can we set up our security so that no one in the IT department is able to access what they should not? Is there a way to guarantee this? Or is it required for the IT admins to be trusted?

In other words, if IT administers our firewall and accounts and security, how can we"police" the police?

Answer 1

What you're asking is not simple. It ranges from very difficult to impossible.

Your company has outsourced the highest privilege level in its environment, and now it wants to prevent those highly privileged individuals from doing something.

They can disable or manipulate any of the native Windows tools. Bitlocker, EFS, etc cannot help you if they have configured GPOs to deploy recovery agent certificates or to backup recovery keys into AD.

They can perform remote monitoring sessions or deploy monitoring/keylogging applications if they want. It takes less than five minutes to setup a software deployment policy if you know what you're doing. You could use non-Microsoft solutions, but those accomplish little if they are running on untrusted systems.

Compartmentalize... if you can.

The problem with compartmentalization is that it's all or nothing. If your email and office apps run on domain systems, it probably won't work.

All of that super important and sensitive data needs to be analyzed, shared, discussed, tasked out, and managed. It will make its way into specifications, project plans, emails, and executive summaries.

If you run unmanaged systems to compartmentalize, you cannot introduce that compartmented data back onto centrally managed machines. This will make some normal business tasks very burdensome. You can run a second, isolated domain to facilitate this---but that is likely more work and expense than simply running everything in-house in the first place.

Accept the risk, or retake control.

In the end, you'll have to make a choice.

You can accept that these contractors have access to sensitive data because they have ultimate control over the systems that process it. Or, you can bring the management roles back in-house, and then you can vet/monitor your admins as you see fit.

Depending on the cost involved, management may simply accept the risk. If there are underlying legal or contractual requirements to protect that data, then maybe the hassle of compartmentalization is worth it.

Answer 2

Some high-profile employees work with sensitive files and data that we need to be sure no one is able to access or steal.

What you're describing is the very definition of Compartmented Information.

Depending upon the degree of sensitivity and risk, you have to make a call as to how far you want to go. In general if your administrators can't be trusted then the special employee systems needs to be isolated or compartmented. Typically this is done by putting the sensitive systems on their own network or even completely standalone.

This of course means they will need to be administered locally by trusted support. If you feel it's prudent in your circumstances, you could keep all of the sensitive data on removeable drives that are encrypted and locked away when not in use.

Once you have an isolated system, you also have to decide policy and control for moving data on & off the system. You need to address the use of the compartmented files and how the information folds into the general business.

Obviously these compartmented systems should not be connected to the Internet, which means no Office 365 among other things.

Answer 3

A detailed contract, with well defined roles, boundaries, and a hefty fine if anything goes wrong is the way to go.

Have a logging server outside the domain, setup file auditing domain-wide, and tell the admins you will hire an auditing firm to take a look from time to time. This will establish your company as a high-security one, so the remote admins will know the consequences of a data breach, intentional or accidental.

Put honeypots on managers' computers: files with remote servers, logins and passwords, on easy to find places and suggestive names. Monitor those servers for any login usage. Don't send this by email, of course. Tell the managers on person.