There is a management aspect, and this is where carefully delineated delegation of tasks and responsibilities comes in: in organizations that are large enough so that the net admins don't get to personally know the employees, the responsibility of creating users and resetting their passwords should be delegated to the department heads or their proxies - executive secretaries would be an ideal proxy.

If I were working as an admin, the last thing I need or want to hear on the phone is some totally unknown voice asking me either to create users with special privileges or ordinary users, because I have no real direct way ofchecking whether that voice belongs to a legitimate party. It is far safer to let the department head create all departmental users himself or herself, and to require him or her to call me personally when a user needs to have special privileges given: the department head (or his proxy) presumably knows who is in his or her department, and I don't.

Conversely, a new admin deserves to be fired if he or she creates users or gives them privileges solely on the basis of a telephone conversation with a party that's unknown to him or her.

Defense in depht is critically important and should be the backbone of any network security strategy. However, a network design that incorporates redundancy through load balancing, clustering and failover is also critically important to security: the cost of hardware has fallen so much that I think I would be better off running a bunch of cheap ass servers in load balancing, clustering and failover modes than in throwing my resources at a few powerful servers with all the doodahs such as hot swap RAID 5 hard drives that are large enough to requiire high end backup. Dispersion of services through many hosts (you don't want any machine to be simultaneously the PDC, RDBMS server, mail server, web server and ftp server) will reduce the impact of any server being compromised. And all host installations should be designed with disaster recovery in mind: for example, if you cannot restore data faster than 6GB per hour, do you have any business creating 80 GB partitions when you are running a 7X24x365 operation and you are expected to keep a 99.999% uptime? In terms of network security, the two key words are "inside" and "outside": those who have no sense of direction should stay away from careers in network security.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/206/24443#24443