Managing Administrative Risks

By Author: Willsimith
Total Articles: 48
Comment this article

Common Vulnerabilities in Network Management

Security Alert Remember that an administrative account is powerful—so powerful that its owner can use it to destroy a system as easily as she can use it to manage a system.

Common vulnerabilities introduced by administrators include:

Accidentally making the organization's data available to those who should not

have access.

Using a weak password that allows the administrator account to be easily compromised.

Inadvertently introducing a Trojan horse or virus into the system through ordinary

tasks, such as checking e-mail and surfing the Web, performed while logged on as

an administrator.

Reducing security in favor of productivity or performance. When seeking a solution for poor network performance, for example, an administrator might turn off

auditing or unassign IPSec policies.

Sharing the administrator accounts so that there is no accountability for administrative actions.

Giving the wrong administrative rights to the wrong people.

Allowing ...
... administrator credentials to be captured when performing administrative

tasks over the LAN, the WAN, IT Exams(http://www.buyitexam.com) or the Internet.

Allowing the administrative session to be captured when remote administration is performed. If this happens, the attacker gains information that -will assist him in

compromising systems or deducing something about the network or the organization.

Inadvertently deleting or modifying company or system data.

What Are Isolation and Autonomy?

Autonomy is a situation in which external control is possible even while local control is the way things are done. Isolation means that there is a clear, precise boundary and that there is no inherent connection or way for administrators from one network to administer another. This section provides guidelines for applying isolation and autonomy to administrative roles and provides several examples and free exam papers(http://www.examshots.com) for people.

Guidelines for Applying Isolation and Autonomy to Administrative Roles

In a decentralized organization, you must determine whether absolute isolation is required or whether simple autonomy is OK. That is, can each separate group, given its own sphere of management, accept that control over its function can be usurped by headquarters? Can the group work within such a framework, or do they need to exist in isolation? Must there be no connection that could possibly allow intrusion upon their administrative authority? In some organizations, this isolation is imperative. There might also be legal reasons that require it.
Defining administrative roles within organizations is difficult. One of the first decisions to make is how far authority will extend. Each part administers its own IT certification(http://www.buyitexam.com) .In some organizations, centralized control is the norm. Although delegation of administrative authority might be applied, central administrative roles assign, supervise, and monitor all administrative functions. In other organizations, a more decentralized approach is used. The organization might be logically divided and different parts given autonomy over the management of their users and computers.