Where the Recording Happens
Proxy, agent and target-side capture have different coverage, different failure modes and different amounts of trust in the recorded system.
Reference
The architecture determines what can be captured, what an administrator can evade, and what happens when a component fails.
Proxy-based
The session passes through a broker that captures it in transit.
Advantages: nothing installed on the target; the record is outside the recorded system; coverage is uniform across everything routed through it.
Limitations: only captures what goes through the proxy, so enforcing the path is everything; may struggle with protocols it does not fully parse.
The most common model and generally the right default.
Agent-based
Software on the target system captures activity locally.
Advantages: captures activity regardless of how the session was established, including local console access; can capture at the process level rather than only what crosses the wire.
Limitations: requires deployment and maintenance everywhere; an administrator on the target can potentially interfere with it; not possible on appliances and closed systems.
Useful where the path cannot be enforced, and as a complement rather than a replacement.
Target-side native logging
The system's own audit facilities — shell history, command auditing, platform audit logs.
Advantages: no additional software; frequently already available.
Limitations: the recorded person can usually alter it; coverage varies enormously by platform; not designed as evidence.
Worth enabling and shipping off-box, and not sufficient alone.
Cloud API logging
The platform records every API call.
This is the recording for cloud administrative activity, where interactive sessions are the minority.
Enable in every region and account, including unused ones.
Ship to a destination the account administrators cannot alter, which is the control that makes it evidence.
Frequently forgotten in programmes designed around servers.
Choosing
Proxy as the default, with the path enforced at the network layer.
Agent on systems where the path cannot be enforced, or where console access matters.
Native logging everywhere, shipped centrally, as a backstop.
Cloud API logging always, for cloud estates.
Combine rather than choose, and accept that no single approach covers everything.
Failure modes to plan for
The proxy is unavailable: does administration stop, or does it fall back to an unrecorded path? Decide deliberately.
The agent fails: is the session blocked or allowed unrecorded? Both are defensible; not deciding is not.
Storage fills: sessions must not be silently unrecorded.
Alert on all three, and treat unrecorded privileged sessions as an incident rather than as an operational detail.
Coverage measurement
Proportion of privileged sessions recorded, which requires knowing the denominator.
Sessions established outside the brokered path, detected from target-side authentication logs.
Systems onboarded against systems in the inventory.
A programme that reports high recording coverage without measuring the denominator is reporting on what it captured, not on what happened.
Deciding fail-open or fail-closed
When recording is unavailable, the session either proceeds unrecorded or does not proceed.
Fail closed is correct for tier zero, where an unrecorded privileged session is not acceptable.
Fail open may be correct for lower tiers, where blocking administration causes more harm than an unrecorded session.
Decide per tier, in advance, and write it down.
Alert loudly either way, because both outcomes are incidents.
Test both, because the behaviour under failure is frequently not what the configuration implies.
The console gap
Agentless recording captures sessions through the broker and nothing else.
Physical console access is invisible to it.
Out-of-band management interfaces — the lights-out controller on a server — are a separate administrative path with their own credentials.
Hypervisor console access to a virtual machine bypasses the network path entirely.
Each is a route to administrative access with no recording unless deliberately addressed.
Onboard the management controllers as systems in their own right, and restrict hypervisor console access as a tier zero capability.