Secure system administration
Page 1 of 6
System management is a fundamental component of any system. Poor design in this area could have any number of serious side effects - from allowing an employee to make a damaging mistake, to permitting an attacker to gain unrestricted access to your most sensitive data.
Having a strategy in place will help your organisation protect these high value systems. This guidance will help you develop and implement your own secure system administration strategy, based on five design principles.
These principles can be applied to both Information Technology (IT) and Operational Technology (OT) systems. IT systems are those that typically handle data, the way it moves around and is stored. OT systems are typically used to manage physical processes and machinery.
Audience
This guidance has been written to address a wide audience. However, it is expected that system designers, risk owners and people in system administration roles will benefit most. This is because they are responsible for the design, development, deployment and operation of a secure system.
More specifically, this guidance should be beneficial to systems where there is a need for remote management of system components.
Budget holders may also find that this guidance serves to highlight the importance of secure system administration when financial decisions are being made.
Additionally, if you outsource your IT support, this guidance may help you gain an understanding of what to look for when assessing potential solutions and suppliers.
Administrators and Administration
Before considering your current system administration practices, it’s important to clarify the terms administrator and administration.
A system administrator is the person or process responsible for carrying out functions which support the deployment or operation of a system.
This could mean an individual whose job title is 'database administrator.' Alternatively, it could be a system account that is responsible for running a scheduled task periodically. The commonality here, is that they carry out functions that a normal user would not. To do this, they have a higher level of permissions on the system.
System administration refers to the acts carried out by administrators. Again, this has a wide definition and could include:
- using SSH to access a web server to update a file
- adding a new user to a domain
- configuring an alarm on a physical valve in an OT environment
The commonality here, is that all of these functions could be used for malicious purposes and so they need to be appropriately protected.
Maintaining your management systems
Administrators don't have to be members of your staff. It's common for system administration to be carried out by a third party supplier. So, this guidance will apply to anyone who has access to your administration interfaces.
You will also need to consider how you maintain any management system that you put in place. At some point, someone, somewhere will have absolute control over your system. It's important that you have considered this and put an appropriate process in place for this access.
Principles of Secure System Administration
Example Scenarios
Throughout this guidance we will refer to two example scenarios. They provide differing perspectives, based on levels of risk.
We will apply the principles below to each of them in order to give you a clearer understanding.
Example Scenario A - Small Company
A small company uses SSH to connect to a front end web server, that hosts an information-only website.
If the administration interface was compromised, it could cause a loss of reputation for the company but would not impact day to day operations.
Example Scenario B - Large Company
A Critical National Infrastructure (CNI) company uses a thick client to control a valve in their OT environment.
If the administration interface was compromised, it could lead to a loss of service that is critical to the health of many citizens.
The Principles
- 1
Gain trust in your management devices
You need to be able to trust the devices you use to access your system administration interfaces. If not appropriately secured, an attacker could use them to gain access to your systems, leveraging legitimate administration functionality.
- 2
Protect your administration interfaces
The administration interfaces to your systems and services give users high system privileges, by design. Protecting them is critical. Only legitimate and authorised users should be able to access them.
- 3
Risk manage administration using tiers
Not all administration is the same. Some access gives a person the opportunity to do more harm to your systems than others. Apply pragmatic risk management to the administration of your systems. We recommend using tiered administration to do so.
- 4
Use privileged access management
Carefully control who, where, when, why and how people perform system administration. Give administrators least privilege. Take access away when it's not needed.
- 5
Log and audit administration activities
Log all administration activities that are carried out. Audit, to make sure administrators are only carrying out legitimate and approved actions.
