System administrators always get super-user access. Third parties, increasingly located wherever, are often granted super-user access as well, usually to smooth project implementations. Super-user access is thrown around willy-nilly because it’s a hell of lot easier than documenting privileges which is really, really boring work.
This leads to poor outcomes: downtime, systems in “undocumentable” states, security holes etc.
The horrible truth is that somebody somewhere must be able to gain super-user access when required. It can’t be avoided.
The other horrible truth is that when you allow super-user access only because properly defining a particular role is hard, you are in effect, giving up control of your environment. This is amplified when more than one team shares super-user access. It only takes one cowboy, or an innocent slip-up, to undermine confidence in an environment.
In this increasingly abstracted IT world, where architecture mandates shared, re-usable applications, where global resourcing mandates virtual remotely-located teams, where IT use and and server numbers exponentially increase and where businesses increasingly interact through gateways, security increasing looks like a feature tacked on at the last minute.
Security costs a lot and adds nothing to the bottom line – though lack of it can and will lead to some big bottom line subtractions.
The mainframe guys had this licked ages ago. The super-user excuse is looking rather thin.
The Age of Authorization is upon us…
Update: An amazing story from San Francisco, which outlines how lack of IT knowledge at the top of an organisation, and too much power devolved to to few IT staff, can cause much grief.
