CAS-002 · Question #609
Which of the following activities could reduce the security benefits of mandatory vacations?
The correct answer is D. Have a replacement employee run several daily scripts developed by the vacationing. Mandatory vacation is a detective control intended to surface fraud by having an independent employee perform the duties; allowing the replacement to run scripts authored by the vacationing employee defeats this purpose.
Question
Which of the following activities could reduce the security benefits of mandatory vacations?
Options
- AHave a replacement employee run the same applications as the vacationing employee.
- BHave a replacement employee perform tasks in a different order from the vacationing
- CHave a replacement employee perform the job from a different workstation than the
- DHave a replacement employee run several daily scripts developed by the vacationing
How the community answered
(44 responses)- A2% (1)
- B11% (5)
- C5% (2)
- D82% (36)
Why each option
Mandatory vacation is a detective control intended to surface fraud by having an independent employee perform the duties; allowing the replacement to run scripts authored by the vacationing employee defeats this purpose.
Running the same applications is expected and appropriate; the replacement can still observe anomalous behavior or unexpected output while using standard tools.
Performing tasks in a different order may actually increase detection likelihood, as deviations from established sequences can surface hidden irregularities.
Using a different workstation does not undermine the detective effectiveness of mandatory vacation and may provide additional audit trail visibility for forensic review.
When a replacement employee executes scripts written by the vacationing employee without independently understanding them, any malicious logic, unauthorized transactions, or fraudulent automation embedded in those scripts continues to run undetected. The security value of mandatory vacation comes from having an independent party scrutinize the work, which is entirely negated if the replacement blindly executes the original employee's automation. This allows a malicious insider's activities to persist through the vacation period with no independent review.
Concept tested: Mandatory vacation as fraud detection and separation of duties
Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Topics
Community Discussion
No community discussion yet for this question.