{"id":1529,"date":"2017-01-13T15:03:11","date_gmt":"2017-01-13T05:03:11","guid":{"rendered":"https:\/\/girl-germs.com\/?p=1529"},"modified":"2017-01-13T16:11:21","modified_gmt":"2017-01-13T06:11:21","slug":"the-ethics-and-morals-of-operations-how-much-access-is-too-much","status":"publish","type":"post","link":"https:\/\/girl-germs.com\/?p=1529","title":{"rendered":"The ethics and morals of operations – how much access is *too* much?"},"content":{"rendered":"

<\/a><\/p>\n

A discussion in 2016 on Twitter & in \/r\/sysadmin<\/a> made me pose this question: “How much access do you consider is too much? Is there such a thing as too much access? How much access is actually needed to do our jobs?” Not only that, but a few situations recently have given rise to the fact that a number of admins think that just because they have the ability to do something, it means they can. <\/p>\n

This is totally not the case.<\/p>\n

I was (for a fair while there!) on the board of SAGE-AU<\/a>, which has now formed into ITPA<\/a>. The same Code of Ethics<\/a> applies to this new organisation and while I’m not currently a member, I still try and uphold these ethics because of the level of access, power and responsibility I (as a system administrator) hold over systems that are so crucial to my organisation.<\/p>\n

I’m very much of the opinion that you access only what you need to access to do your job. No more. This should be pretty straight-forward, but apparently it’s not. It comes down to professionalism. You have special access rights to be able to do your job – not to satisfy your curiosity. If a user requests you to do something on their computer, access their computer. If they are having issues with some files, access the files (provided they’ve said you can). Don’t look at things you’re not supposed, don’t go prying into things that you have no work-related reasons to be looking into.<\/p>\n

There’s also the implied responsibility that while you may have access to do things you’re not supposed to, you don’t do it. This includes giving yourself more access than you should (such as unfiltered internet access), modifying things you shouldn’t (such as log files to hide when you’ve done something you weren’t supposed to) or accessing files simply because you can (such as copying video files or images from users directories). The examples I’ve given above – I’ve seen in action in other admins. What makes it worse, these were senior admins who should know better. As a younger admin, seeing this behaviour, it was almost condoned. Seen as normal. I now know that this behaviour isn’t. It’s not something we, as system administrator (or any IT professional with high levels of access) should be doing. Ever.<\/strong><\/p>\n

When admins abuse their power this way, they’re not only jumping over the line of acceptable behaviour, but they’re showing to younger admins who may be looking up to them for professional guidance that this is acceptable. There’s also the issue that abuses like this can be audited – if you have any type of security logging in place, it’s simple for someone else to see what’s been done. But is anyone actually paying attention? It’s a “Quis custodiet ipsos custodes?” moment – Who guards the guards?<\/strong><\/p>\n

There are definitely methods out there to limit this kind of access. There’s a reason that least privilege is what’s pushed hard for these days – you only have access to what you absolutely need<\/strong> access to, in order to your job. However that gets murky when you have a sysadmin who has access to absolutely *everything*.<\/p>\n

The other side of this is what happens when people get caught doing this. In some cases, it’s a sackable offence. For others, it can even be criminal – but that comes down to what’s been done, who’s done it and (most importantly) why.<\/p>\n

So, a few questions to pose that I would like as many people as possible to answer – feel free to reply in comments, hit me up on Twitter, flick me an email, anything. Just be aware that any answers you send through may be collated into a “This is what sysadmins think” post (but with your responses given full attribution to you unless you request to be anonymous):<\/p>\n