IT personnel cannot effectively manage their infrastructure without admin-level access. But with gaining this access comes great responsibility. Most companies do not effectively allocate their resources or implement enough technology tools to prevent information security risks. Often enough the response to countless regulations is to concentrate on building controls against external and internal business users, while ignoring IT administrators who more often than not have access to information well beyond the scope of their jobs. Recent damaging and costly incidents (UBS, City of San Francisco) prove that companies in any vertical industry, and of any size can be affected.
Giving administrators unlimited system authority is a reality for the foreseeable future, especially in SMB organizations that cannot afford Enterprise-level solutions. Traditional controls are ineffective against administrators armed with full access to all resources. Controlling administrative authority risks is key, and protecting the integrity of the company’s Active Directory is paramount- this is recognized as a vital piece of any organization’s security strategy. A domain administrator in an Active Directory forest can gain root access to any other domain (and therefore member system) in the forest.
Having sufficient separation between the AD administrators and other IT personnel has its own special set of challenges. The best ways of meeting these challenges differ according to an organization’s size. Small and midsized organizations often lack dedicated IT security staff. In those organizations, IT professionals are already busy keeping many different technologies operational. Other small or midsized organizations may employ an information security officer but that individual is often a generalist and frequently lacks the time or technical knowledge to manage this process. Large enterprises generally have dedicated staff to ensure this separation, but they end up overloaded by unnecessary fragmentation. Organizations in any one of these situations can benefit from the role delegation available in the Active Directory Manager. This application will allow the creation of specific roles, accessing specific containers, objects or reports within AD- depending on specific job functions. IT users can be assigned to these roles and thus maintain the separation between HelpDesk, system admins, IT generalists, etc. The Active Directory Manager reduces administrative costs by providing a dynamically configured and customized Web-based interface for each job function. IT personnel have access only to the resources necessary to perform their job function and nothing else. Thus a tighter security policy can be implemented- one that will reduce the threat and impact derived from the actions of rogue IT personnel and mitigate the information security risks.
