Monitor the application layer: Monitor the activities of end-users that access sensitive data via multi-tier enterprise applications such as SAP, PeopleSoft and Cognos. Well-designed DAM solutions can associate specific transactions at the database tier with specific end-user accounts, in order to deterministically identify individuals that are violating corporate policies. In addition, combining database auditing information with access logs from applications and host system, via a Security Information and Event Management (SIEM) system, to see everything that a user has done, can also provide critical information and analytics for forensic investigations.
Review entitlements: Periodically review entitlement reports (also called User Right Attestation reports) as part of a formal audit process. Make sure you follow the principle of “least privilege,” but remember that DBAs typically need to have privileged access to sensitive databases to accomplish their jobs (hence the need to monitor and audit their activities). Enforce corporate policies that forbid sharing of privileged credentials, since this eliminates accountability.
Don’t forget terminated employees: There are numerous examples of former employees who stole data from ex-employers or sold their administrative credentials on the black market. Make sure IT is involved in the employee termination process, so that all of the former employee’s accounts – including remote access – are automatically de-provisioned immediately.
What tips would you give to an organization considering migrating to a cloud computing solution for mission-critical IT services? Furthermore, to what degree will they have to reorganize their overall approach to risk management?
Treat the use of public clouds like any other outsourced activity: check cloud provider references, review their policies, and make sure that all of your key requirements (such as SLAs, backup and disaster recovery, encryption, change and configuration processes, privileged user monitoring and auditing, etc.) are specified in your contract with them.
You should also audit your cloud provider periodically, but this may be more difficult with larger and well-established cloud providers, in which case you’ll need to rely on 3rd-party audits such as SAS70. The SAS 70 audit verifies the functionality of a service organization’s control activities and processes, but keep in mind that SAS 70 itself does not specify a pre-determined set of control objectives that service organizations must achieve -- so make sure their documented controls meet all of your organization’s specific requirements.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.