Outside of a ticketing system, obviously.
I'm talking about tracking AD changes, NTFS permissions changes, etc.
Are you creating domain admins for each tech and leveraging advanced event logging, or using any third party tools? Or flying blind? I'm increasingly finding that just logging remote access sessions is not nearly enough.
Posted Sep 23, 2019, 2:43 PM UTC
We've started to rollout Liongard and it syncs to ITGlue. This gives us some of the audit history, it tracks AD changes such as user adds and changes to security groups. It also tracks changes to Sonicwall firewall configs.
Truth be told, we document but do not audit to the level of NTFS permission changes. We've not yet had any issue and most client equipment isn't speced to handle that load in capacity and processing very well.
I won't argue that better security practice would be to enable auditing. But, I feel that there is a point where you're spending more compute and storage resources on auditing/logging than you are on business productivity. It's one of the security vs. cost benefit compromises that you have to decide on.
[deleted]
Lionguard and Xia Configuration Manager are two tools you might want to look into.
flying blind
We really just don't. Change requests are tracked through tickets and beyond that we have a level of trust in our internal staff. I also feel that if this level of auditing this was a requirement for a client it would be fairly specific so I've never put thought into a blanket solution for this case. 80/20 rule applies here.