RE: [CISSP-D] Security Officer privileges over audit logs?????

Ali;
 
That all depends...
 
If you're speaking of his ability to review the system generated audit logs, or 
even 'control' the system generated audit logs after creation then I would say 
that it is his/her job to do so.
 
I'm guessing that you are looking for a conflict of interest here.  If that is 
the case then managing the logs after generation is not a conflict.  Good 
system administrators regularly review their systems audit logs.
 
If, on the other hand, the QSEC was the one generating/creating the audit logs 
(actually sitting down at the terminal and choosing what information will be 
included in the report) then you might have a conflict.  In this case, they 
would have the ability to NOT add information to the report, maybe information 
that would implicate a friend?
 
So to boil it down, if the QSEC has the ability to add/change/delete 
information in the audit report I'd be concerned.  If the audit is truly system 
generated and just handed to the QSEC for review or control, I'd say that this 
is completely normal.
 
Tracy
 
T.S. Lad, Inc.
www.tslad.com





------------------------ Yahoo! Groups Sponsor --------------------~--> 
$4.98 domain names from Yahoo!. Register anything.
http://us.click.yahoo.com/Q7_YsB/neXJAA/yQLSAA/kgFolB/TM
--------------------------------------------------------------------~-> 

 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/CISSP-Discuss/

<*> To unsubscribe from this group, send an email to:
    CISSP-Discuss-unsubscribe@yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/