Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Orchid Retail's board learns that a disgruntled systems administrator, who still holds privileged access after being passed over for promotion, could copy customer data. Which feature of this risk most strongly implies the strategic response the board should prioritise?

The board should control privileged access, monitor activity and enforce segregation of duties. The threat comes from an authorised insider who already passes the perimeter, so firewalls alone are inadequate. Insider risk can be reduced through access management, so inaction or insurance alone is inappropriate.

  1. AStrengthen perimeter firewalls, because the threat is an external hacker
  2. BControl privileged access, monitoring and segregation of duties, because the threat is internal and authorisedCorrect
  3. CBuy cyber insurance only, because insider threats cannot be mitigated
  4. DDelay action until a breach occurs, so the loss can be quantified

Explanation

An insider with legitimate privileges bypasses perimeter controls, so the response should focus on least privilege, activity logging, segregation of duties and prompt access revocation. Firewalls address external threats. Insurance transfers only part of the impact and insider risk can be mitigated; waiting is poor risk management.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions