Who gets the magic scepter when there are three of it?

[Jefe de redacciÃn <editorialstandards -at- gmail -dot- com>]

I had a nice table where I described a system of authentication tokens that
should normally be held by different people. Separation of roles.
The table included a column of suggested persons/roles in an organization
who should be the holders of the individual tokens, like the CSO (Chief
Security Officer), CIO (Chief Information Officer), head system administrator,
and so on.

The new, improved system allows each of those authentication tokens
to be split across multiple physical devices, to ensure that no one person
can present the complete authentication for a role without
oversight/participation
by fellow token-split holders.

Now, the question is what happens to the suggestions (above) when there's
usually only one CSO, one CIO, one head of system admin, etc. in
an organization. We can hardly suggest that the CSO keep one split of
his token, give one to his secretary, one to the janitor...
We know that the janitor is an independent cuss, but we think the
secretary might be influenced by her boss (the CSO) to look the other
way, or to lend her split-token fragment inappropriately.

Old, established, security-minded (institutionally-paranoid) corporations
and government departments, and spy agencies will have thought this
out already, but there are always new-kid companies and orgs that are
just arriving at the righteously-paranoid stage and would like to see
suggestions for implementation.

Any suggestions, please?
No, can't ask any of the existing paranoid companies/agencies. They
keep such things close to their vests, and react badly to perceived prying.
Don't want my corpse being found in discrediting circumstances.

-- 
 Â__o
_`\<,_
(*)/ (*)
Don't go away. We'll be right back. Â.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Create and publish documentation through multiple channels with Doc-To-Help. 
Choose your authoring formats and get any output you may need. Try 
Doc-To-Help, now with MS SharePoint integration, free for 30-days. 
http://www.doctohelp.com

LavaCon 2010 in San Diego Sept 29 - Oct 2 is now open for registration.  
   Use referral code TECHWR-L for $50 off conference tuition! 
          See program at: http://lavacon.org/


---
You are currently subscribed to TECHWR-L as archive -at- web -dot- techwr-l -dot- com -dot- 

To unsubscribe send a blank email to 
techwr-l-unsubscribe -at- lists -dot- techwr-l -dot- com
or visit http://lists.techwr-l.com/mailman/options/techwr-l/archive%40web.techwr-l.com


To subscribe, send a blank email to techwr-l-join -at- lists -dot- techwr-l -dot- com

Send administrative questions to admin -at- techwr-l -dot- com -dot-  Visit
http://www.techwr-l.com/ for more resources and info. 

Please move off-topic discussions to the Chat list, at:
http://lists.techwr-l.com/mailman/listinfo/techwr-l-chat