CAS-002 · Question #49
The Chief Information Security Officer (CISO) is researching ways to reduce the risk associated with administrative access of six IT staff members while enforcing separation of duties. In the case…
The correct answer is B. Require role-based security on primary role, and only provide access to secondary roles on. Role-based access control (RBAC) satisfies both requirements: it enforces separation of duties by default (each admin only has their primary role), while allowing temporary or on-request access to secondary roles when covering for an absent colleague. This is sometimes…
Question
The Chief Information Security Officer (CISO) is researching ways to reduce the risk associated with administrative access of six IT staff members while enforcing separation of duties. In the case where an IT staff member is absent, each staff member should be able to perform all the necessary duties of their IT co-workers. Which of the following policies should the CISO implement to reduce the risk?
Options
- ARequire the use of an unprivileged account, and a second shared account only for
- BRequire role-based security on primary role, and only provide access to secondary roles on
- CRequire separation of duties ensuring no single administrator has access to all systems.
- DRequire on-going auditing of administrative activities, and evaluate against risk-based
How the community answered
(37 responses)- A19% (7)
- B68% (25)
- C5% (2)
- D8% (3)
Explanation
Role-based access control (RBAC) satisfies both requirements: it enforces separation of duties by default (each admin only has their primary role), while allowing temporary or on-request access to secondary roles when covering for an absent colleague. This is sometimes implemented as a 'break-glass' or on-call process. Option A introduces shared accounts, which is a security anti-pattern - shared credentials eliminate individual accountability and auditability. Option C (no single admin has access to all systems) would prevent the cross-coverage requirement stated in the scenario. Option D (auditing alone) is a detective control, not a preventive one - it monitors behavior after the fact but does not reduce the risk of inappropriate access in the first place.
Topics
Community Discussion
No community discussion yet for this question.