How should a generalist sysadmin handle security without a dedicated specialist?
Asked by
MellowCedar47
I recently started a systems administration role expecting to handle application deployments and project management under the direction of a security leader. That security support turned out not to exist, and leaving the job is not currently practical. I'm now responsible for making reasonable security decisions without much specialist guidance.nn1. CrowdStrike is our endpoint protection platform, but I'm unsure how much proactive scanning it performs versus detecting threats when they execute. What trustworthy tools or processes can provide a second opinion for suspected hidden malware?n2. One machine had a serious malware infection. Is DBAN still appropriate, or is ShredOS the better option? Is wiping and reimaging sufficient, or should the hardware be discarded?n3. How should a small organization without a security specialist address AI-related risks, such as employees entering sensitive information into public AI services?nnI'm also looking for practical ways to document these responsibilities and communicate the risks to management without trying to carry the entire security program alone.
Answers
You were asked to cover a security function that wasn’t part of the job you accepted. Create a written risk register showing the gap, likely impact, recommended mitigation, approximate cost, and who needs to approve it. Send it to management and keep dated copies. That gives the company a concrete plan and makes it clear which risks are accepted by leadership rather than silently assigned to you.
Reply to this answer
For an ordinary malware infection, you generally don’t need to throw away the computer. Remove or replace the drive, securely erase it if it will be reused, and perform a clean operating-system installation from trusted media. ShredOS is a current option for drive wiping. If the investigation suggests a firmware-level compromise, the response is different, but that is unusual compared with an infostealer or regular operating-system infection. Make sure credentials and tokens used on the affected machine are rotated as part of the cleanup.
Reply to this answer
CrowdStrike is primarily behavior-focused, not just a scanner that waits for a file to launch. It monitors process activity and can identify suspicious chains and actions. For a one-off second opinion, a reputable scanner such as Malwarebytes or ESET can be useful, but constantly layering free scanners on top of your EDR usually creates more anxiety than security. Follow the alerts, review the investigation data, and use your organization’s incident-response process.
MellowCedar47: The documentation advice helps most. I’m going to write down what is and isn’t covered, then send management a prioritized list instead of keeping it all in my head.
Reply to this answer
Small companies without security staff often start with a very limited AI policy: provide one approved business tool, prohibit entering customer data, credentials, source code, or other confidential material into public services, and block or restrict unsanctioned tools where practical. Add basic access controls, logging, employee training, and a review process rather than trying to predict every future AI threat. A security consultant or managed security service can help if the organization needs monitoring and incident-response coverage.
Reply to this answer
Add your answer
Answers are reviewed before publication.
QuietPineapple6: A simple partition change is not a secure wipe, so it shouldn’t be treated as one. For reuse, use the manufacturer’s secure erase process or an appropriate full-drive erase; for sensitive data, follow the organization’s media-destruction policy.