Related Posts
Bowl Leader
Conversation Starter
How much do strategy directors make these days?
Coach
Additional Posts in Risk Assurance
What makes more money IT Audit or IT GRC?
New to Fishbowl?
Download the Fishbowl app to
unlock all discussions on Fishbowl.
unlock all discussions on Fishbowl.
Just an A1 here, but I’ve seen us test users with sudo access for appropriateness and/or implement a control that requires users to obtain approval to the use the root account, and then a ticket gets automatically created with the log of the actions the user performed which gets reviewed and approved.
If you find yourself needing to go down the route of auditing user activity who have sudo access, then what you're really looking at is a finer SOD issue. In this case, I would not really do an exhaustive user activity test as long as I can obtain evidence of two or three instances of sudo user activity that does not align with the R&R
I would say a point in time test of users is pretty weak (but not unheard of if there arent many users or if the company is small). Typically id like to see a UAR unless inappropriate sudo access has been identified as a problem in the past in which case an activity review may be appropriate. At the end of the day tho - you're testing the client's controls and whatever they have in place is what you test. You can identify a control gap if you feel their control is inadequate to address the risk but you can't test what they're not doing 🤷♂️
You define what privileges you’re looking for first and then use the sudoers file to figure out who can access those privileges. If you’re ever needing to track OS activity you’re already pretty fucked unless the client has some sort of monitoring programs in place.