If the only IT administrator also manages the security logs, then how do we control that?

Start

One IT administrator also controls the security logs

The logs are how anyone would find out that administrator rights were misused. When the same person holds the rights and controls the logs, misuse and its record can disappear together. It is a common position in a company with one IT person, and it can be covered.

• Then: Record it as a High conflict

Step

Record it as a High conflict

Administering a system and reviewing its logs is a High conflict in the pack's matrix: one person could misuse access and then change or delete the entries that record it. Standing administrator rights that combine the two are not emergency access. They follow the full conflict routine and are normally rated High.

• Then: Does anyone else see administrator activity today?

Decision

Does anyone else see administrator activity today?

Yes only if someone other than the administrator already receives alerts or reviews activity, from data the administrator cannot alter. A log the administrator can clear does not count. If you are not sure, answer no.

• Yes: Can someone else take over the log review?
• No, or not known: Tell the risk owner and agree a stopgap now

Step

Tell the risk owner and agree a stopgap now

In the pack's defaults, a High conflict with no control is reported to the risk owner and the line manager within 2 working days, with an interim measure agreed straight away. Here that might be the provider checking the administrator group membership and logging settings until the full controls are running.

• Then: Can someone else take over the log review?

Decision

Can someone else take over the log review?

Separation always comes first. A managed security service or the outsourced IT provider may be able to own log review outright, or a second administrator may be joining. With one administrator and no outside party to take the duty, the answer is no. Record the reason, usually headcount.

• Yes: Move the log review, and confirm the administrator cannot alter logs
• No: Forward logs to a store the administrator can only read

Outcome

Move the log review, and confirm the administrator cannot alter logs

Give the review to the other party, and remove the administrator's rights to change or delete the logs. Confirm it with a fresh access listing. The conflict is then closed and needs no exception.

Step

Forward logs to a store the administrator can only read

Send the logs to a central or cloud log service where the administrator has read-only rights. Misuse can then no longer be erased from the record. The alerts and the monthly review both read from this store.

• Then: Alert someone else when admin groups change or logging stops

Step

Alert someone else when admin groups change or logging stops

Set alerts on changes to administrator groups, on audit settings changing, on logs being cleared and on logging stopping. Send them to someone other than the administrator, such as the IT provider and the managing director, where the administrator cannot switch them off.

• Then: Have someone else review admin activity every month

Step

Have someone else review admin activity every month

In the pack's example, the IT provider reviews a summary of administrator activity monthly. The reviewer pulls the report from the log service themselves, covers everything since the last review, signs and dates it, and follows up anything unexplained. Where the system allows, grant administrator rights for a limited time rather than permanently, so each use shows up.

• Then: Did a test alert reach every recipient?

Decision

Did a test alert reach every recipient?

Trigger a harmless test, such as a change to a test administrator group, and confirm each recipient received it. An untested control is listed on the exception request but does not lower its score. If the test did not reach everyone, fix the rule and test again.

• No, or not known: Fix the alert rule and test again
• Yes: Does the administrator also hold the security role?

Step

Fix the alert rule and test again

Check the rule, the recipients' addresses and that the administrator cannot silence it. Keep the test record: it is part of the control's evidence, with the rule's configuration and the alert history.

• Then: Did a test alert reach every recipient? (back to an earlier step)

Decision

Does the administrator also hold the security role?

In a small company the only IT person often also acts as information security, and so would assess and approve an exception for their own conflict. Nobody may decide an exception they requested or whose control they operate. If you are unsure whether they would be involved in the decision, answer yes.

• Yes, or not known: Name someone else to assess and approve it
• No: Raise the exception, scored with the tested controls

Step

Name someone else to assess and approve it

The decision passes to the next level up. In the pack's example, the standard names the managing director to approve in place of the administrator acting as information security, and the IT provider acts as information security at each review.

• Then: Raise the exception, scored with the tested controls

Step

Raise the exception, scored with the tested controls

The conflict rating and the exception's score are different things. In the pack's example the conflict is High, but the exception scores Medium: severe impact, with likelihood lowered one step by the tested controls. In the pack's defaults a Medium exception is decided by the head of information security, or whoever stands in for them, for up to 180 days. Record it in your exception register with its review date.

• Then: At the quarterly review, did the checks run and find nothing odd?

Decision

At the quarterly review, did the checks run and find nothing odd?

Each quarter, whoever acts as information security, here the provider, confirms that the alerts still fire and that every monthly review happened, done by someone other than the administrator. A missed month or a review the administrator prepared is a failed control. Anything unexplained in the activity summary is a separate answer.

• Yes: Could the log review now be moved to someone else?
• No: a check missed or self-run: Failed control: re-score without it and tell the risk owner
• Something unexplained: Handle signs of misuse through the incident route

Outcome

Failed control: re-score without it and tell the risk owner

Score the exception again at once without the failed control. Without it the likelihood is not lowered, so the band and approver may rise. Report the conflict to the risk owner, and restore the control before the next review.

Outcome

Handle signs of misuse through the incident route

Unexplained administrator activity, missing logs or logging that stopped without a reason may mean the conflict has been misused. Raise it under your incident procedure and, where money or fraud may be involved, your fraud or whistleblowing route. Do not ask the administrator to investigate their own activity.

Decision

Could the log review now be moved to someone else?

Ask at every review. A second hire, a managed security service or a new feature in the log service may make separation possible. If so, separate it and close the exception.

• Yes: separate now: Can someone else take over the log review? (back to an earlier step)
• No: Covered and checked: renew the exception at expiry

Outcome

Covered and checked: renew the exception at expiry

Record the review and the next date in your register. At expiry the exception is scored again and renewed, and once its renewals run out it goes to the next approval level up. Management should see, at least once a year, that this duty is combined and how it is watched.