Practice 10: Use Extra Caution with System Administrators and Technical or Privileged Users

System administrators and technical or privileged users have the technical ability, access, and oversight responsibility to commit and conceal malicious activity.

What Can You Do?

Recall that the majority of the insiders who committed IT sabotage held technical positions such as system administrator, DBA, or programmer. Technically sophisticated methods of carrying out and concealing malicious activity included writing or downloading of scripts or programs (including logic bombs), creation of backdoor accounts, installation of remote system administration tools, modification of system logs, planting of viruses, and use of password crackers.

System administrators and privileged users⁵ by definition have a higher system, network, or application access level than other users. This higher access level comes with higher risk due to the following.