SSH

Zombie attacks.

Password compromises.

Privilege creep.

To require acceptable usage of IT systems

To reduce the organizational risk

To ensure that staff conform to the policy

To ensure that false positives are identified

Privacy Policy

Mandatory Vacations

Least Privilege

Acceptable Use

Least privilege access

Mandatory vacations

Separation of duties

Mandatory access control

Software vulnerabilities in vendor code

Poor password security among users

Fraud committed by a system administrator

The need for additional security staff

Collusion between two employees who perform the same business function.

Help desk technicians with oversight by multiple supervisors and detailed quality control systems.

Acts of gross negligence on the part of system administrators with unfettered access to system and no oversight.

Acts of incompetence by a systems engineer designing complex architectures as a member of a team.

Technical control

Risk control

Physical control

Privacy control

Mandatory Vacations

Acceptable Use

Least Privilege

Privacy Policy

Implement privacy policies

Implement a security policy

Enforce time of day restrictions

Enforce mandatory vacations

Enact a policy that employees must use their vacation time in a staggered schedule.

Implement a single sign-on application on equipment with sensitive data and high-profile shares.

Create a single, shared user account for every system that is audited and logged based upon time of use.

Separate employees into teams led by a person who acts as a single point of contact for observation purposes.