This is a tricky issue I'm dealing with at the office. Management has a very... interesting concept of segregation of duties when it comes to traditional 3 tier applications.
I'm trying to figure out if this is an internal culture which grew out of a broken telephone game, or if it is part of some framework which I haven't encountered before.
Application Administrators ~~~~~~~~~~~~~~~~~~~~~~~~~~ Management Me ~~~~~~~~~~ ~~ Application Reader X X Application Admin X X OS User O X OS Admin O O Database User (ro) O O Database User (rw) O O Database Admin O O OS Administrators ~~~~~~~~~~~~~~~~~ Management Me ~~~~~~~~~~ ~~ Application Reader O O Application Admin O O OS User X X OS Admin X X Database User (ro) O O Database User (rw) O O Database Admin O O
There are vague comments about ITIL, and other vague comments about "external" policies. No specifics.
Does anyone know of any principles of segregation which might prevent an Application administrator from having any OS level access?
I'm specifically speaking of 3-tier apps. Keep in mind the OS admins do not have expert knowledge of the Application. Application Administrators are responsible for providing customized install guides to the OS admins, who quietly mess it up, leaving us to troubleshoot without access to see what they did wrong.
It sounds to me like a very fractured adaptation of a software development model, but I can't quite put my finger on it.