iso27diy-corp/Corpus/ISMS/Segregation of Duties.md

Segregation of Duties

• Implementing Segregation of Duties ISACA
• Segregation of Duties in Auditing
• a-5.3-Segregation-of-duties
• ISO_27002_2022_5.3_PE Segregation of duties
• Functiescheiding Typologie Starreveld
• Trias Politica

Segregation of Duties ensures no single person has enough authority or access to compromise the system or data on their own.

From a dead blog:

Two primary objectives:

• prevention of conflict of interest (real or apparent), wrongful acts, fraud, abuse and errors.
• detection of control failures.

There is an easy test for Separation of duties. 1. Can any one person exfiltrate classified information without detection? 2. Can any one person alter or destroy classified information without being detected? 3. Does any one person have influence over controls design, implementation and reporting of the effectiveness of the controls?

The answers to all these questions should be “no.”

So:

1. Determine what is sensitive information and label it
2. Log access to sensitive information.
3. Separate access rights (incl. modification and deletion) from the rights to modify controls or logging.
4. Separate design and implementation of security controls from testing, auditing, monitoring and reporting.

Responsibilities for controls (DIME model):

• Design
• Implementation
• Monitoring / reporting
• Evaluation
• Auditing

Also:

• The security officer should not report to the CIO, as she is responsible for having no cybersecurity issues.
• Use a third party to monitor security and conduct tests and audits.