Best Practices - Enforcing the review of Firefighter Logs/Reports

[Former Member]

Hi,

I am looking for some best practices as it pertains to the review of Firefighter Usage Logs. How are companies these days reviewing, documenting, and enforcing that system generated FF logs/reports are indeed being reviewed and monitored? Anything you can share is greatly appreciated.

I have seached the GRC forum, Firefighter Post, and reviewed the recently released "Super User Access" article, but have only found information on the tool's functionality and technical specs.

Regards,

Edited by: jmsreyes on Jul 20, 2009 6:38 PM

[Former Member]

Hi,

There is no standard or best practices in enforcing the review of FF logs and reports. Every client/company plan their own strategy around this.

One of my client used to ask every controller to print out and file the printed paper with their signature on it. They were required to keep this for a year or so. Another client asked them to print it to pdf and save it to a secure location which will mean they have reviewed this log. If there is any issue, it will be the responsibility of the particular FF controller.

Regards,

Alpesh

[Former Member]

Hi,

I agree with Alpesh, every client strategy may be different based on their audit reasons.

We use Access enforcer to provision firefighter access and FF logs reviewed by AE approvers. For audit reasons, we print and prepare binder with all FF logs along with managers sign-off that is on monthly basis.

Hope this helps.

-Laks