Passwords for privileged accounts should be given only to people with a need for privileged access. Wherever feasible, a login banner, stating that the system is for authorized use only, should be displayed for anyone attempting to connect to the system. Providing this information makes attacks easier by allowing intruders to pinpoint hosts with known security vulnerabilities. Logs of user activity must be retained for a period of at least six months. Knowledge that logs are kept acts as a deterrent to abuse.
Logs are also essential in investigating incidents after the fact.
Systems administrators are responsible for taking proactive steps to assure the security of the server. Examples include regularly checking for weak user passwords and checking the system for common security vulnerabilities. Systems administrators must implement backup procedures consistent with the requirements of the Data Steward. Management must retain copies of the original software licenses for commercial software used in their department. For site-licensed software, management must retain a copy of the site license.