Can the two-man rule foil insider threats?
Connecting state and local government leaders
The NSA, embarrassed by leaks about its covert activities, installs a two-man rule for access to sensitive information. There are other ways to shore up systems, too, though none are perfect.
In the wake of embarrassing leaks by Edward Snowden about the National Security Agency’s domestic and international intelligence gathering, the agency is trying to figure out how it lost control of this information and how to prevent it from happening again.
As to how it happened, NSA Director Gen. Keith Alexander has a pretty good idea, at least at a high level: Too many people with access.
Alexander told the House Select Permanent Intelligence Committee on June 18 that NSA now has at least 1,000 systems administrators, a growing number of them contractors, like Snowden. Administrators are defined by their privileges on IT systems, their ability to access, define and change just about anything they want. One thousand is a lot of administrators to keep track of. Many people, Alexander included, think it is too many by at least one.
“Clearly the system did not work as it should have,” the general said in a June 23 appearance on ABC News’ This Week. “He betrayed the trust and confidence we had in him.”
The problem of administrative creep is not a new one, nor is it unique to the NSA or government.
“It’s a common audit finding that organizations have too many administrative personnel,” said Dave Frymier, chief information security officer at Unisys. Unisys faced the same problem when it found one day it had more than 100 Microsoft administrators. That number eventually was reduced to fewer than 15. “It just shows that they’re human,” he said of the NSA.
Alexander offered some ideas on how NSA plans to deal with the problem of trust. “We are now putting in place actions that would give us the ability to track our system administrators, what they're doing, what they're taking. A two-man rule,” he told ABC’s George Stephanopoulos.
The “two-man” rule requires two people with separate sets of credentials for access to sensitive resources. It can be expensive in terms of manpower and is not fool-proof, but most in the security community think it is a good idea, especially in an environment as sensitive as the NSA.
“I fall into the category of people who wonder why they hadn’t been doing this all along,” Frymier said. “It’s expensive, but it’s one of the better solutions to the problem.”
It is not the only solution, of course. The first — and most obvious — fix is to minimize the number of systems administrators. As with many simple solutions, however, this is easier said than done. While having a lot of administrators can be a security risk, it also helps to lighten workloads and make it easier to keep systems up and running. People tend to care about security risks only after an incident, but they care about having their systems running seven days a week, so convenience often trumps security.
A second solution is to reduce the privileges given to each administrator. Not all of them need all of the privileges all of the time. A system to grant privileges as required and to revoke them when a task is completed can make it easier to manage the managers. Microsoft has a more fine-grained administrative environment than Unix, and there are off-the-shelf tools to help with this process in a Microsoft environment. Unfortunately, NSA appears to be largely a Unix shop, Frymier said. But with its resources, the agency probably could develop its own administrative tools.
Another good security practice is to log all administrator activity. The problem with this is that logs often are looked at only after an incident, and administrators often have the ability to alter logs. This is where a system for real-time monitoring and alerting for suspicious activity would come in handy.
There are any number of other steps for segregating and protecting sensitive data, but none of them fool-proof. Eventually you have to trust someone with sensitive information. “At some point the problem is a human resource problem rather than a technical one,” Frymier said.
So the Cold War saw of “trust but verify” makes sense. “The two-man rule really is the best solution to the problem,” Frymier said. “It’s a good way to get a vast improvement.”