Preventing Good People From Doing Bad Things: Implementing Least Privilege

In todays turbulent technological environment, its becoming increasingly crucial for companies to know about the principle of least privilege. These organizations often have the best security software money can buy, with equally developed policies with which to execute them, but they fail to take into account the weakest link in their implementation: human nature. Despite all other efforts, people can sway from what they should be doing.

Preventing Good People from doing Bad Things drives that concept home to business executives, auditors, and IT professionals alike. Instead of going through the step-by-step process of implementation, the book points out the implications of allowing users to run with unlimited administrator rights, discusses the technology and supplementation of Microsofts Group Policy, and dives into the different environments least privilege affects, such as Unix and Linux servers, and databases.  

Readers will learn ways to protect virtual environments, how to secure multi-tenancy for the cloud, information about least privilege for applications, and how compliance enters the picture. The book also discusses the cost advantages of preventing good people from doing bad things. Each of the chapters emphasizes the need auditors, business executives, and IT professionals all have for least privilege, and discuss in detail the tensions and solutions it takes to implement this principle. Each chapter includes data from technology analysts including Forrester, Gartner, IDC, and Burton, along with analyst and industry expert quotations.

• Why unlimited administration rights are a bad thing
• Why least privileges is a good solution
• Effective implementation of least privileges
• Least privileges on Unix and Linux servers
• Issues with Microsoft's Group Policy

The audience is segmented into three separate categories, all of which are clearly addressed and weighed-in on in each chapter: the auditor, the businessman, and the IT professional.

Auditor

The first segment are the information technology security auditors. They are the ones responsible for the analysis of technical, physical, and administrative controls in the organization(s) whose security is in question. Their work includes the auditing of data center personnel, computer equipment, all policies and procedures, physical and environmental controls, and back-up procedures. Because their jobs so heavily rely on established protocols for the protection of sensitive information, this segment of the market will find this book a must-read. Their main concern is making sure the companies they are inspecting are in compliance with regulations and are taking the appropriate measures to secure their infor...