We would like to secure our administration network from advanced persistant threats and also from rogue administrators. I have already read the best practices from SANS Institute, NSA or other guides.
We have separate physical networks for administration and production and admin workstation don't have internet connection, usb ports, etc... We also have encrypted databases.
Actually, this is not preventing some rogue admin to backdoor the database server to get the key (as decryption is done on database server). We could not implement application side encryption as it's proprietary software.
I want to implement zero-access administration for sensible production servers. I would like to do so by having the servers themselves pulling administration scripts and execute them only if they are signed (pgp) by at least 2 admins (with an agent and something like a git repository). (like code review but enhanced with some crypto). With that, I think that we will obtain an administration network without any single point of failure. Someone will need at least 2 administrators accounts involved to execute code on sensible servers.
I would like to know if you have some advices for protecting our administration network from rogue administrators and APT ?
I would also like to know your opinion on this kind of administration (all scripted) and if you have already implemented something like that (or have some examples)? (ie: How NSA is doing after Snowden ?)
Is there any other good practice to protect from leakage by administrators (with the constraint of not being able to encrypt the data application side) ?