Reference no: EM133613139

Testing and improving controls

As you have discovered in this course, any controls implemented by an organisation must be thoroughly monitored and tested. Introducing a range of new control measures (such as access control) creates the potential for new risk challenges. Stress testing is one method to assess these controls for the likelihood of risk.

A stress test is a simulation that measures the resilience of controls against potential compliance failures. This can be done via hypothetical scenarios and ethical hacking - a process intended to reveal vulnerabilities in a system. Stress testing is particularly valuable for organisations if the testing relies on less predictable methodologies used by hackers and criminals.

For this small group discussion forum, engage with the fictional case study and discuss ways to rectify the situation using what you've learnt about monitoring and reporting in this module.

Case study:

Kimi is a compliance officer who has been asked to stress test an organisation that has just implemented a new access control solution. Employees, security officials, and custodial staff have recently been issued access cards. The cards are used for physical movement within the premises and access to printing services. All employees have been trained on the new access control processes and systems.

How can Kimi circumvent these controls as part of a stress test?

First, Kimi hires a pregnant actress to request a visitors' access card from the front desk security officer so that she can use the bathroom facilities that are behind an access-controlled turnstile. The security guard does not know how to program the card correctly, so he lets her use his card. However, Kimi has given the actress a card skimmer, which she used to copy the security guard's access card.

Kimi uses the cloned card to enter the building. Because security officials typically have access cards that allow access throughout entire premises, Kimi is able to gain sensitive information simply by walking around and taking photos after most employees leave work in the evening.

She notes that some staff members have written their new passwords on sticky notes placed in accessible areas (such as on a work-station monitor, or under a keyboard). This allows Kimi to employ an ethical hacker to access the data systems and copy valuable personal information and intellectual property.

Question

Imagine that you are the compliance officer for this organisation. How would you control for the conduct failure that occurred? Can you suggest a means of monitoring to improve these controls?

You can speak to any of the following points in your discussion:

Analysis: Is it possible to improve on the existing controls (the established security system and staff training) to prevent unwanted access and card skimming?

Ethics: How do you feel about refusing to help a person in need with a minor and seemingly harmless request? How would you balance the needs of the organisation with those of human beings?

Reporting: Which stakeholders should be informed and consulted regarding such an incident? How would you report the event to these stakeholders?

Implementation: Can you suggest any further controls that may be useful in managing this risk? How could these then be monitored to ensure they are performing as intended?