4

IT Security Pros are very smart people who need to give your environment with the respect and care that the business requires.

Part 1

  • What are the traits you look for in an employee before approving them for sensitive access (root passwords, domain admin, etc)?

  • What warning signs do you look out for that may give you concern?

This person we're talking about can be anyone from an internal employee, an external auditor, or even a vendor /3rd party who you do business with.

Part 2

  • Does any of this change if the person in question has unique skills that no-one (including yourself) has, and may have the ability to outsmart any auditors that may be watching?

closed as primarily opinion-based by schroeder Dec 13 '17 at 20:26

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

6

Employee security clearance is a major issue for organisations, and even more so in positions of sensitivity such as admin, root or super-user roles. My usual thumb, is to assume that these roles can do much more damage than a normal user so heavily protect your organisation from them. Traits may be the wrong word though - as many traits of highly skilled professionals are the same as highly skilled criminals.

In some countries this is easier than others, but basic security clearances include credit and criminal checks (if an individual is heavily in debt they become more amenable to persuasion from criminal elements, and a criminal history should rule out individuals for sensitive roles, especially if it was a crime associated with IT fraud.) Known associates should also be researched.

For highly sensitive roles, regular rechecks may be required. And an awareness of your employees behaviour could be a value add! Salaries should also be reviewed - underpaid roles are a straightforward target for bribery and corruption.

This doesn't really change if the individuals has unique skills, as underlying the roles should be an infrastructure which prevents misuse, for example restricting administrative rights to only those required should be a given. For most platforms, root or Administrator access is not required, so where relevant a Power User or lower should be used, and root should be restricted to emergency occasions - where it requires input from two individuals:

an example:

Database admins often demand full superuser rights, but this is almost never needed. There are many types of admin role which can be assigned as appropriate, and root can be a break-glass role which requires retrieval of a password from a safe, or from two individuals each holding half.

To summarise - yes, IT gurus are essential but dangerous; protect yourself from them with technical and procedural controls, research their background and use their skills to add value.

  • 3
    Basic background checks are a must for high security roles. Frankly they should be required for most roles in IT (IMO). – Steve Dec 2 '10 at 0:49
2

At a minimum background checks. After that I look for instances where they needed to make difficult choices, specifically looking at how they handle authority and power. Since I don't have an interest in micro managing someone I need someone that isn't going to try and be Napoleon.

If someone makes a lot of excuses I would start to get concerned. I want someone that will own up to mistakes they make and move the conversation forward. None of my views would change it the person had unique skills since we're not afraid to train people. It's common for us to send someone to training for certification with our EMR (electronic medical record) right after they started.

Not the answer you're looking for? Browse other questions tagged or ask your own question.