Question

An organization makes each lead system administrator responsible for the security of the systems he or she runs. However, the management determines what programs are to be on the system and how they are to be configured.

(a) Describe the security problem(s) that this division of power would create.

(b) How would you fix them?

Answer 1

a)

The security mechanism in a company mainly depends on who is responsible for the company's security.
The power to implement appropriate controls must reside with those who are responsible. if management decides
what programs are to be (run) on their machines, then the system administrators(security analysts) who are responsible for the security,
Who see the need (demand) for security measures will be unable to Implement the appropriate security measures.
since management is not (less) aware of the technical aspects compared to system administrators, it's possible for
administration to make some poor choices about cost and resources and security measures.
Also, the coordination between the system coordinates is also pivotal in any organisation,
and this organisation may be compromised if the management decides to make some key security decisions

b)

It (The problem) can be fixed by providing system administrators (security analysts) with more control and powerful and sufficient resources for administering computer systems. Before making any decision on the security issue,s the management should consult the system administration. If the company has more than one (multiple) divisions, then each division should have a separate system administrator. The company have one security head who has knowledge about security issues and who heads(leads) all the system administrators.
Management should give all the powers to him( security head) to take all the critical security decisions.
Security head (who leads all the system administrators)
Should take care of delegating the appropriate security tasks to the concerned system administrators(based on their given wing). Part of the management role requires them to know about the cost and resources and
security policies etc., and management can get up to date about these by consulting the security