Why the ‘two-man rule’ is only the beginning

In the raging debate over the data breach at the National Security Agency, here’s a nugget that deserves more attention than it has received: The NSA'a director, Gen. Keith Alexander, recently instituted a two-man rule to limit the previously unfettered access of the 1,000-plus systems administrators who work for the agency. It ensures that no single person can gain access to confidential, sensitive and often top secret data.

This is a great first step toward reining in the access, and resulting power, of IT administrators. Still, it’s no more than a step. The whole situation should instead serve as a wake-up call for government organizations and corporations that have had their heads in the sand.

Here’s the insider threat issue in a nutshell: Administrative accounts provide godlike privileges over the entire infrastructure, including systems, applications and data -- anything that’s managed by systems administrators. Through the cloud, infrastructure administrators can access and make copies of every virtual machine at an organization, and can delete and destroy a private cloud in a matter of minutes.

But because most organizations look at security from the outside in, they put up strong perimeter controls to keep bad guys out but do very little or nothing to lock down internal systems.

That has to change. Not only are insiders and systems administrators a very real threat, but external attackers can use sophisticated advanced persistent threats to steal employee credentials and privileges and gain access to carry out and escalate attacks.

Again, the two-man rule is a good idea. It is conceptually the same security mechanism that prevents a single person from launching a nuclear missile. (Remember Denzel Washington and Gene Hackman in “Crimson Tide”?) The two-man rule enforces oversight so that a rogue administrator cannot access confidential information or otherwise create havoc. Every government organization and corporation should have something like this in place as a matter of protocol.

However, the two-man rule should also be part of a larger set of policies and access controls to ensure least-privileged access (through which employees are able to perform only those operations that are part of their normal job duties) and need-to-know access (under which they are able to manage and access only the resources they’re responsible for).

To do this right, security policies need to be lightweight and not cumbersome; otherwise, they won’t be followed. For example, policies should be enforced transparently, and workflow for secondary approval as part of the two-man rule should be automated.

For the record, this isn’t nearly enough. Most important, organizations need continuous role-based monitoring and alerting to remain aware of what administrators are doing. Having an unobstructed view of the enterprise, which this methodology enables, is the best way to let administrators do their jobs while retaining the ability to head off rogue actions.