312-50V10 · Question #555
A Network Administrator was recently promoted to Chief Security Officer at a local university. One of employee's new responsibilities is to manage the implementation of an RFID card access system to…
The correct answer is A. Segregation of duties. Assigning the same person both the ability to grant RFID access and the responsibility to review access logs violates segregation of duties, eliminating independent oversight of that access.
Question
A Network Administrator was recently promoted to Chief Security Officer at a local university. One of employee's new responsibilities is to manage the implementation of an RFID card access system to a new server room on campus. The server room will house student enrollment information that is securely backed up to an off-site location. During a meeting with an outside consultant, the Chief Security Officer explains that he is concerned that the existing security controls have not been designed properly. Currently, the Network Administrator is responsible for approving and issuing RFID card access to the server room, as well as reviewing the electronic access logs on a weekly basis. Which of the following is an issue with the situation?
Options
- ASegregation of duties
- BUndue influence
- CLack of experience
- DInadequate disaster recovery plan
How the community answered
(49 responses)- A78% (38)
- B12% (6)
- C4% (2)
- D6% (3)
Why each option
Assigning the same person both the ability to grant RFID access and the responsibility to review access logs violates segregation of duties, eliminating independent oversight of that access.
Segregation of duties (SoD) is a security principle requiring that no single individual control two or more phases of a sensitive transaction or process without independent oversight. In this scenario, the Network Administrator can both issue access credentials and review the audit logs that would reveal any abuse - meaning they could grant unauthorized access and then conceal it during the weekly log review, creating an unacceptable single point of failure in the access control process.
Undue influence describes improper pressure exerted over another party's decision-making or contractual agreement, which is not the structural access-control problem described here.
Lack of experience is not indicated anywhere in the scenario - the issue is a policy and control design flaw, not the administrator's competency.
An inadequate disaster recovery plan relates to backup and restoration capability - the off-site backup explicitly mentioned in the scenario suggests DR planning is already in place.
Concept tested: Segregation of duties in access provisioning and audit
Source: https://csrc.nist.gov/projects/risk-management/sp800-53-controls/release-search#!/control?version=5.1&number=AC-5
Topics
Community Discussion
No community discussion yet for this question.