Quis custodiet ipsos custodes?

The above phase means “who will guard the guards themselves?” and is relevant in many security contexts.

Here in Denmark, we are currently having our own “News of the World” affair. In our case, a contractor at the payment processor handling almost all Danish credit cards was able to automatically send a tip to a journalist whenever a celebrity used his or her credit card. That makes it hard to take an incognito honeymoon like Prince Joachim of Denmark tried (and failed).

This contractor had system administration privileges and was able to continue this illegal monitoring for years without being detected.

Too many IT systems have an all-powerful system administrator. It’s more convenient for the system administrator, but it is not good IT governance. All kinds of sensitive operations need both an operator doing the task and an auditor checking that only the relevant tasks were carried out. Naturally, the audit trail needs to be protected so the operator cannot change it. Not even if he is a system administrator.

Do you know what data and which operations in your systems are sensitive? And are they appropriately protected?