It's about activity, not privileged users

Controlling the actions of privileged users is the cornerstone of just about every compliance regulation. I was speaking about the chances of this approach becoming a really effective approach to security with Ted Julian of Application Security. The discussion, which could’ve used one more latte, centered on the need for security to focus on securing business intellectual property and transactions. Policing of people, while important, is way over-emphasized.

In my experience, the results of corporate initiatives to control access of privileged users and applications almost always fall way short of expectations. The reason is simple: security seldom knows who all of the privileged users are, and people’s job responsibilities and business requirements keep changing. The administrative demands of keeping up-to-date become impractical, leading to great relaxation of all of the access control restrictions.

Privileged users are the company’s greatest assets -- the trust that the organization puts in them is how they became privileged in the first place -- so they do need some leeway to do what is best for the company... as long as they are authenticated and operations on critical resources are audited. Control and oversight of all activity affecting sensitive data is what business requires.

Standard operating procedure is to have independent auditing of business operations. Businesses must account for who is accessing sensitive data and modifying infrastructure configurations and executables, and must audit what the activity was. It doesn’t really matter if it is a privileged user, application developer, or non-privileged user. What is important is what all users are doing with sensitive information. Vigilance over privileged activity might well have detected patterns of abuse at DuPont, TJX, and the Veterans Administration in time to head off a crisis. It is not the people; it is the activity.