Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 280
  • Last Modified:

Lack of formal documented policies

What is the risk of not documenting formal procedures for basic systems administration? I have a systems admin who says the amount of day-to-day tasks they’d need to document would be never ending. But our external auditors for example made a recommendation that, per quarter, “a quarterly assessment should take place to verify that members of privileged security groups (such as domain admins) still have a valid business need”, which is fair enough, and a good idea to do.

But they say unless the procedure is documented it’s not an effective process? Why so? If an admin does do these checks whether or not the process to do so is documented somewhere, if the work is being done, what’s the risk? Why is the documentation so vital? Or is it? There are other issues, such as backup restore testing, i.e. test a restore once per quarter, change control procedures etc etc. Many of these tasks will be being done but the process to do them is not always documented. But without documenting it, but still physically doing the work, what is the issue.
0
pma111
Asked:
pma111
3 Solutions
 
Pramod UbheCommented:
documentation makes your organization process dependent instead of person dependent.

We have a security group created let's say Group 1 which has access to modify members of privileged groups like domain admin or ent. admin and whenever there is a need of any admin to member of domain admin or ent. admin someone from Group1 grants the access to complete the work. In this way you follow the process and there is no work stoppage as well.
0
 
Nagendra Pratap SinghCommented:
Documentation stops cowboy admins.
0
 
giltjrCommented:
Documentation may not really stop cowboy admins.  Procedure enforce does that.  What are procedures, documentation on how do do things.

One of the biggest things documentation does is prevents the re-invention of the wheel.  Especially when the only person that has been doing a job for the last 5, 10, 15, 20 years comes in and says:

      I just won the lottery, I quit!!!!  Now go figure out what I've been doing for the last X years.
0
 
pma111Author Commented:
To what extent though do you document. Say for general day-to-day management and administration of database and file servers, what specific procedures do you document? I know this is the classic "it depends on your company" but surely there are some common ones per every IT shop?
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now