CAS-003 · Question #678
A PaaS provider deployed a new product using a DevOps methodology. Because DevOps is used to support both development and production assets inherent separation of duties is limited. To ensure…
The correct answer is A. Configuration of increased levels of logging, monitoring and alerting on production access. When separation of duties cannot be enforced structurally in a DevOps model, enhanced logging and monitoring of production access serves as the recognized compensating control under security frameworks.
Question
A PaaS provider deployed a new product using a DevOps methodology. Because DevOps is used to support both development and production assets inherent separation of duties is limited. To ensure compliance with security frameworks that require a specific set of controls relating to separation of duties the organization must design and implement an appropriate compensating control. Which of the following would be MOST suitable in this scenario?
Options
- AConfiguration of increased levels of logging, monitoring and alerting on production access
- BConfiguration of MFA and context-based login restrictions for all DevOps personnel
- CDevelopment of standard code libraries and usage of the WS-security module on all web servers
- DImplementation of peer review, static code analysis and web application penetration testing
How the community answered
(20 responses)- A60% (12)
- B25% (5)
- C5% (1)
- D10% (2)
Why each option
When separation of duties cannot be enforced structurally in a DevOps model, enhanced logging and monitoring of production access serves as the recognized compensating control under security frameworks.
Security frameworks such as PCI-DSS and ISO 27001 explicitly permit compensating controls that provide equivalent risk mitigation when primary controls are infeasible. Comprehensive logging, monitoring, and alerting on all production access creates a detective and deterrent layer - any improper or unauthorized action by DevOps personnel is recorded and triggers alerts for review. This satisfies the audit and accountability intent of separation of duties controls without requiring a structural re-organization of the DevOps team.
MFA and context-aware login restrictions strengthen authentication assurance but do not compensate for the absence of role separation between development and production responsibilities.
Standard code libraries and WS-security modules address secure development practices and web service integrity, which are unrelated to compensating for operational separation of duties.
Peer review, static analysis, and penetration testing are software quality and security testing controls applied during the development lifecycle, not compensating controls for production access separation.
Concept tested: Compensating controls for separation of duties in DevOps
Source: https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf
Topics
Community Discussion
No community discussion yet for this question.