1. Some of my employees are seeking privileges that I feel compromise the integrity of my network. Could you share some best practices for network security so that I can prove how dangerous these priveges are?
ANSWER
If someone can't provide a valid *business* justification for the escalated privileges, we fight strongly against providing them. If a business application requires escalated privileges, we escalate the issue with that vendor to make it clear to them that requiring escalated privileges is against the corporate security policy, and that if they can't provide a workaround, we won't be buying or using their product. In today's environment, many software vendors have more restrictive access requirements that they can run under, but that they do not always make publicly known (you need to ask for them). If all else fails though, we then work under the basic premise of the most restrictive rights possible. So before we make a user a local administrator, we will check and see if they can do what they need to do as a power user. Before we make a user a power user, we will check to see if we can grant specific rights to the user (or more practically to a group the user is a member of) or specific rights to the appropriate registry keys or files. The bottom line here though is, your best weapon is the ability to demonstrate how the users can perform all of their required business responsibilities at the lower privilege level.
Category
