From e342ead779022fd1e2c4e2d6c1c1e8ecaade80de Mon Sep 17 00:00:00 2001 From: Martin Ashby Date: Fri, 11 Aug 2023 23:33:18 +0100 Subject: Post four-eyes --- content/posts/2023-08-11-4-eyes.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 content/posts/2023-08-11-4-eyes.md (limited to 'content/posts/2023-08-11-4-eyes.md') diff --git a/content/posts/2023-08-11-4-eyes.md b/content/posts/2023-08-11-4-eyes.md new file mode 100644 index 0000000..0ba76ef --- /dev/null +++ b/content/posts/2023-08-11-4-eyes.md @@ -0,0 +1,15 @@ +--- +title: "Four Eyes" +date: 2023-08-11T22:50:43+01:00 +draft: false +--- + +The four-eyes principle (also known as [two-man rule](https://en.wikipedia.org/wiki/Two-man_rule) or no-lone-zone) stipulates that for certain very critical operations like the launch of a nuclear weapon or the handling of very sensitive cryptographic key material, at least two qualified persons must be actively involved. + +I think the same principle should hold true in some IT operations work; for example some servers are running software that is both very important to keep running, and is also handling very sensitive data. Examples might be banking or healthcare services. A mistake or malice while operating this software can be very harmful. For example: causing significant [downtime for a healthcare system](https://www.bbc.co.uk/news/uk-england-london-62308447) can result in degraded level of care for patients in hospitals. Another example: [leaking details of police staff](https://www.bbc.co.uk/news/uk-northern-ireland-66467164) can result in serious harm to those staff. + +I work for a fully-remote software company which handles healthcare data and provides live services using that data. One additional challenge of fully-remote working is securing access to servers. Remote access to servers is a hard requirement: in order to do my job I must access servers that run our software. However, this means that the security of those servers is only as good as my own [physical security](https://xkcd.com/538/). + +There is a hole in the market for a remote 'four-eyes' system. My boss suggested something as 'simple' as an SSH server which requires _two_ separate authorized users to access, and where every shell command must be confirmed by both users before executing. This means at least _two_ system administrators must be compromised (or complicit) in order for a breach to occur. In theory this is significantly less likely than a single administrator being compromised. + +There are [packages](https://pkg.go.dev/golang.org/x/crypto/ssh) for Go and other programming languages which implement the SSH protocol, and I think it's possible to implement such a server. It's something I plan to explore. -- cgit v1.2.3-ZIG