|
The nature of software—whether operating system (OS) or application—is that it constantly evolves, requiring regular updates throughout its lifetime as new features are introduced. Similarly, over time, software often becomes more complex, requiring patches to fix programmer errors or mitigate vulnerabilities. From the aspect of actually using the software, change is inevitable through updates to configurations, the addition and removal of users and groups, and so on. Essentially, change is a natural part of the life across IT. Managing and implementing these changes is often left to an experience group of administrators who are familiar with the system or application to which the change is being applied. However, this specialized group is often overwhelmed with different projects on top of trying to manage change request tickets that can quickly escalate beyond their ability to effectively manage each request.
Ultimately, changes requests are either implemented poorly, extremely late, or not at all. On top of the challenges of merely managing these change requests, auditors are constantly pushing for controls over who can manage what, that an administrator’s entitlements are within the scope of his or her job, and ensuring that all changes and activities are tracked and audited. To reduce the workload of administrating their mission-critical technologies, organizations must delegate administrative access and privileges—but carefully, as changes that are inadvertent and untested can quickly bring an infrastructure to its knees.
Organizations must also track and audit all administrative tasks and changes, not just to satisfy the auditors but also to quickly identify and respond to risky or unapproved changes.
This paper discusses why organizations should consider moving to a delegated administration model. This model can aid companies in improving administrative productivity, system availability, and security, and satisfy the demands of auditors. The paper then discusses the challenges and risks that organizations might face when using various approaches to delegating administrative capabilities. It will then present the delegated administration model implemented across NetIQ technology, and show how—with NetIQ—organizations can successfully delegate appropriate administrative privileges across their organizations. This model is intended to avoid providing each user unnecessarily privileged access and helps ensure a safer operating model.
The Need to Delegate Administrative Entitlements
Every computer environment has some type of default state—that is, the state that it’s in when the system is first implemented. This can vary significantly depending on the OS, version, and even patch level of the system. In most cases, the default state balances three key elements: usability, functionality, and security. No configuration is perfect, of course, so tradeoffs must be made. For example, a feature may be enabled by default (increased functionality) that allows some remote access to the system (decreased security). Unfortunately, the default state is usually not appropriate for your environment. Nearly every environment has different needs depending on numerous factors:
- Industry regulations and practices
- Written company security policy
- Likelihood of the company being attacked
- Security awareness and technical competency of the management and employees
- Contractual requirements
This is just a short list of factors that can influence the security of an organization. In all cases, you will want to change the default security, tailoring it to your specific needs.
Administrative Privilege
One important aspect of security is the administrator’s privilege or level of security access to resources. In most standard security models, network administrators can perform all security-related functions and other users cannot. This hard line between non-admins and admins can prove troublesome. There are usually tasks that, while traditionally carried out by an admin, must be assigned to a non-admin. For example, you may want the Human Resources organization to create user accounts when employees are hired. User account management is normally an admin-level entitlement. Therefore, you have to choose between granting administrator status to the HR personnel or having IT perform this task. When this same example occurs in the industry, many organizations choose to grant administrative status to the HR personnel in order to easily implement the requirement.
|
