CAS-002 · Question #349
Executive management is asking for a new manufacturing control and workflow automation solution. This application will facilitate management of proprietary information and closely guarded corporate…
The correct answer is E. Human resources. HR's requirement for automated data interchange with an external cloud SaaS application poses the greatest security risk by creating an uncontrolled pathway for sensitive proprietary data to leave the organization.
Question
Executive management is asking for a new manufacturing control and workflow automation solution. This application will facilitate management of proprietary information and closely guarded corporate trade secrets. The information security team has been a part of the department meetings and come away with the following notes:
- Human resources would like complete access to employee data stored in
the application. They would like automated data interchange with the employee management application, a cloud-based SaaS application.
- Sales is asking for easy order tracking to facilitate feedback to
customers.
- Legal is asking for adequate safeguards to protect trade secrets.
They are also concerned with data ownership questions and legal jurisdiction.
- Manufacturing is asking for ease of use. Employees working the
assembly line cannot be bothered with additional steps or overhead. System interaction needs to be quick and easy.
- Quality assurance is concerned about managing the end product and
tracking overall performance of the product being produced. They would like read-only access to the entire workflow process for monitoring and baselining. The favored solution is a user friendly software application that would be hosted onsite. It has extensive ACL functionality, but also has readily available APIs for extensibility. It supports read-only access, kiosk automation, custom fields, and data encryption. Which of the following departments' request is in contrast to the favored solution?
Options
- AManufacturing
- BLegal
- CSales
- DQuality assurance
- EHuman resources
How the community answered
(20 responses)- A5% (1)
- B10% (2)
- D5% (1)
- E80% (16)
Why each option
HR's requirement for automated data interchange with an external cloud SaaS application poses the greatest security risk by creating an uncontrolled pathway for sensitive proprietary data to leave the organization.
Manufacturing's ease-of-use requirement is a usability concern that presents minimal direct security risk to proprietary data.
Legal is raising data protection concerns rather than creating security risks, making it a safeguard rather than a threat vector.
Sales requires read-oriented order tracking with customer-facing data, which poses a lower risk to trade secrets than an automated external data interchange.
Quality assurance is not mentioned in the scenario and has no stated requirements that would create a security risk.
HR's request introduces an automated, persistent data flow between the on-premises manufacturing application - which stores trade secrets and proprietary information - and a third-party cloud SaaS platform outside the organization's direct control. This directly conflicts with Legal's concerns about data ownership and legal jurisdiction, as data written to a cloud SaaS may be subject to the provider's terms and the laws of the jurisdiction where it is hosted. Unlike the other departments, HR's requirement creates a structural data egress channel that is difficult to monitor and difficult to revoke once established.
Concept tested: Data sovereignty and third-party SaaS integration security risk
Source: https://csrc.nist.gov/publications/detail/sp/800-144/final
Topics
Community Discussion
No community discussion yet for this question.