Security

Why the ‘two-man rule’ is only the beginning

Eric Chiu

In the raging debate over the data breach at the National Security Agency, here’s a nugget that deserves more attention than it has received: The NSA'a director, Gen. Keith Alexander, recently instituted a two-man rule to limit the previously unfettered access of the 1,000-plus systems administrators who work for the agency. It ensures that no single person can gain access to confidential, sensitive and often top secret data.

This is a great first step toward reining in the access, and resulting power, of IT administrators. Still, it’s no more than a step. The whole situation should instead serve as a wake-up call for government organizations and corporations that have had their heads in the sand.

Here’s the insider threat issue in a nutshell: Administrative accounts provide godlike privileges over the entire infrastructure, including systems, applications and data -- anything that’s managed by systems administrators. Through the cloud, infrastructure administrators can access and make copies of every virtual machine at an organization, and can delete and destroy a private cloud in a matter of minutes.

But because most organizations look at security from the outside in, they put up strong perimeter controls to keep bad guys out but do very little or nothing to lock down internal systems.

That has to change. Not only are insiders and systems administrators a very real threat, but external attackers can use sophisticated advanced persistent threats to steal employee credentials and privileges and gain access to carry out and escalate attacks.

Again, the two-man rule is a good idea. It is conceptually the same security mechanism that prevents a single person from launching a nuclear missile. (Remember Denzel Washington and Gene Hackman in “Crimson Tide”?) The two-man rule enforces oversight so that a rogue administrator cannot access confidential information or otherwise create havoc. Every government organization and corporation should have something like this in place as a matter of protocol.

However, the two-man rule should also be part of a larger set of policies and access controls to ensure least-privileged access (through which employees are able to perform only those operations that are part of their normal job duties) and need-to-know access (under which they are able to manage and access only the resources they’re responsible for).

To do this right, security policies need to be lightweight and not cumbersome; otherwise, they won’t be followed. For example, policies should be enforced transparently, and workflow for secondary approval as part of the two-man rule should be automated.

For the record, this isn’t nearly enough. Most important, organizations need continuous role-based monitoring and alerting to remain aware of what administrators are doing. Having an unobstructed view of the enterprise, which this methodology enables, is the best way to let administrators do their jobs while retaining the ability to head off rogue actions.

About the Author

Eric Chiu is president of HyTrust. He has also served in executive roles at Cemaphore Systems and MailFrontier, and was a venture capitalist at Brentwood (now Redpoint) and Pinnacle. He is a published author on topics related to cloud and virtualization issues, and speaks at industry forums throughout the world.

Featured

  • Defense
    Soldiers from the Old Guard test the second iteration of the Integrated Visual Augmentation System (IVAS) capability set during an exercise at Fort Belvoir, VA in Fall 2019. Photo by Courtney Bacon

    IVAS and the future of defense acquisition

    The Army’s Integrated Visual Augmentation System has been in the works for years, but the potentially multibillion deal could mark a paradigm shift in how the Defense Department buys and leverages technology.

  • Cybersecurity
    Deputy Secretary of Homeland Security Alejandro Mayorkas  (U.S. Coast Guard photo by Petty Officer 3rd Class Lora Ratliff)

    Mayorkas announces cyber 'sprints' on ransomware, ICS, workforce

    The Homeland Security secretary announced a series of focused efforts to address issues around ransomware, critical infrastructure and the agency's workforce that will all be launched in the coming weeks.

Stay Connected