[Intrusions] Requested opinions on Access.

[M. Shirk]

This is grounds for dismissal or even prosecution (in the government I would 
say).

NIST Guidelines speak to Identification and Authentication. Basically, a 
"Need to Know basis". Security
controls should be in place so separation of duties is possible. They are 
DBA's and should never have
the ROOT password to any unix server. If they need admin privileges for 
certain binaries or scripts, grant
them "Only what they Need", and nothing more.

However, if you have no security policy, they are free to do as they please. 
This is even the case if
today you go and install security controls like integrity checkers, host 
based IDS, or any other techniques. There has to be a policy to hold 
individuals accountable for their actions.

Shirkdog.