Front cover - IBM Redbooks

108 Lotus Security Handbook
► Security administrative authority: The authority given to an individual by
the assignment of attributes or privileges that are associated with access
control systems and that are required for setting and administering
system-wide security controls.
Users with security administrative authority can improperly use their authority in
a way that allows them to alter system components. Users with system authority
can improperly use their authority in a way that allows them to circumvent the
access control system. Either situation should be considered a misuse of
authority.
Each major system platform and subsystem in the infrastructure must include an
access control system. In order to ensure a reasonable level of system security,
the organization’s security policy should contain:
► Identification of the standard access control systems
► Identification of the security administrative authorities associated with these
access control systems
► Mandatory default control and implementation standards for these access
control systems
Provide availability
Ensure system availability meets your organization’s business requirements with
redundancy and fail-over. Although system availability is not always associated
with security, denial of service (DOS) attacks are very real and systems with
single points of failure become extremely vulnerable. And as the redbook team
experienced first-hand, a DOS attack can originate anywhere in the network
through the unwitting release of a worm virus. So do not assume the redundancy
should focus only on external access coming into your network.
Redundancy for the most part should be architected in a manner that hides the
physical redundancy from a user’s point of view. Not only does this provide a
system that is easier for the end users, it also creates an environment that makes
it more difficult for an intruder to directly attack a specific component.
An additional key component of availability is system monitoring. System and
network failures must be detected and responsible parties notified as rapidly as
possible.
Control administrative maintenance activity
Administrative maintenance activity refers to actions performed by staff who
have either system administrative or security administrative levels of access that
relate to system configuration and operation. In other words, the staff has