CISSP PRACTICE QUESTIONS – 20210325

Posted on by
Effective CISSP Questions

Small businesses typically have limited resources, so that software developers may have to support operations. If it’s unavoidable for a developer to assume development and operations activities, which of the following is the best arrangement? (Wentz QOTD)
A. Dual control
B. Segregation of Duties
C. Separation of Privilege
D. M of N Control

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

My suggested answer is C. Separation of Privilege.

Dual control, Segregation of Duties, Separation of Privilege, and M of N Control are security controls used to prevent fraud and error. However, Dual control, Segregation of Duties, and M of N Control require two or more people to complete a task. Separation of Privilege can separate privilege into various accounts but used by the same user. It’s a common practice and suitable for small businesses that have limited resources.

Manu and Rakhi explain those controls very well as follows:

Separation of Privilege

Separation of Privilege

The following is an excerpt from BeyondTrust:

Separation of privilege is an information technology best practice applied by organizations to broadly separate users and processes based on different levels of trust, needs, and privilege requirements. Separation of privilege, also called privilege separation, refers to both the:

  1. Segmentation of user privileges across various, separate users and accounts
  2. Compartmentalization of privileges across various application or system sub-components, tasks, and processes.

Separation of privilege can be implemented in a number of ways, but some common examples include:

  • Separating various administrative account functions from each other
  • Separating administrative and standard account capabilities
  • Separating auditing and logging capabilities within administrative accounts
  • Separating system functions like read, edit, write, execute, etc.

Dual Control

Dual control is “a process that uses two or more separate entities (usually persons) operating in concert to protect sensitive functions or information. No single entity is able to access or use the materials, e.g., cryptographic keys.” (NIST Glossary)

M of N Access Control (Quorum Authentication)

“The HSMs in your AWS CloudHSM cluster support quorum authentication, which is also known as M of N access control. With quorum authentication, no single user on the HSM can do quorum-controlled operations on the HSM. Instead, a minimum number of HSM users (at least 2) must cooperate to do these operations. With quorum authentication, you can add an extra layer of protection by requiring approvals from more than one HSM user.” (Amazon)

Segregation/Separation of Duties (SOD)

“Separation of duties (SoD; also known as Segregation of Duties) is the concept of having more than one person required to complete a task. In business the separation by sharing of more than one individual in one single task is an internal control intended to prevent fraud and error. The concept is alternatively called segregation of duties or, in the political realm, separation of powers. In democracies, the separation of legislation from administration serves a similar purpose.” (Wikipedia)

  • “Segregation of Duties (SOD) is a basic building block of sustainable risk management and internal controls for a business. The principle of SOD is based on shared responsibilities of a key process that disperses the critical functions of that process to more than one person or department. Without this separation in key processes, fraud and error risks are far less manageable.” (AICPA)
  • “Separation of Duty (SOD) refers to the principle that no user should be given enough privileges to misuse the system on their own. For example, the person authorizing a paycheck should not also be the one who can prepare them. Separation of duties can be enforced either statically (by defining conflicting roles, i.e., roles which cannot be executed by the same user) or dynamically (by enforcing the control at access time).” (NIST Glossary)

Reference

A BLUEPRINT FOR YOUR SUCCESS IN CISSP

My new book, The Effective CISSP: Security and Risk Management, helps CISSP aspirants build a solid conceptual security model. It is not only a tutorial for information security but also a study guide for the CISSP exam and an informative reference for security professionals.

小型企業通常資源有限，因此軟件開發人員可能必須支持運營。 如果開發人員不可避免地要進行開發和運營活動，那麼以下哪種安排是最好的？
A. Dual control
B. Segregation of Duties
C. Separation of Privilege
D. M of N Control

Leave a Reply