Re: Conflict of interests

[Sebastien MAHIEUX <sebastien.mahieux () gmail com>]

Hi,

That's an interesting question.
As a security officer and consultant, bank in the past, media
production now, I had usually take control for highest account in the
infrastructure.
Audit team needs a temporary account for it job and request to me.
IT administrator need an admin account provide from Security team.
Indeed, if you have a global overview of your position in your
company, you have to ensure the right privilege for the right people,
ensure end date for contractor and temporary employee.
So you need to have the admin account and with your position, the
admins or audit teams have to request to you. If not, you're not a
security guy but an information risk officer, functionnal and not
technical.

Feel fre to contact me for further details.

2009/5/4  <s0h0us () yahoo com>:
> As a security guy, not part of the IT department, I require a level of access in order to perform my job. Certain 
> types of tools require privileged access in order to work. Like having domain admin access and/or similar privileged 
> access for unix and linux systems. Is it reasonable to request this type of access without causing any type of 
> conflict of interest that internal auditors might question? I guess audit trails would come in handy here.
> Thanks for the feedback.
>
> ------------------------------------------------------------------------
> This list is sponsored by: InfoSec Institute
>
> Learn all of the latest penetration testing techniques in InfoSec Institute's Ethical Hacking class.
> Totally hands-on course with evening Capture The Flag (CTF) exercises, Certified Ethical Hacker and Certified 
> Penetration Tester exams, taught by an expert with years of real pen testing experience.
>
> http://www.infosecinstitute.com/courses/ethical_hacking_training.html
> ------------------------------------------------------------------------

------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Learn all of the latest penetration testing techniques in InfoSec Institute's Ethical Hacking class.
Totally hands-on course with evening Capture The Flag (CTF) exercises, Certified Ethical Hacker and Certified 
Penetration Tester exams, taught by an expert with years of real pen testing experience.

http://www.infosecinstitute.com/courses/ethical_hacking_training.html
------------------------------------------------------------------------