ITPEC IP April 2023 Question 63
As a part of internal control, access management conforming to the segregation of duties is implemented for the use and operation of an information system. During the development of the information system, which of the following is an appropriate process to start taking access management into account?
Explanation
Requirements definition — access management that enforces segregation of duties is a requirement of the system, so it must be settled in the first phase.
Segregation of duties means that incompatible tasks (for example entering a transaction and approving it) are given to different people. For the system to enforce this, the roles, the functions and data each role may use, and the approval routes have to be defined as requirements, so that design, programming and testing can build and verify them. A control decided late may not fit the design and costs far more to add.
Answer (a)
Why not others:
- •(b) Programming — the program implements what the requirements and design already specify; deciding the access model at this stage means redesigning what is already built
- •(c) Test — tests check that the defined access rights work; they cannot check requirements that were never defined
- •(d) After operation start — the system would run without the internal control in place, and changing a live system is the most expensive time to add it
Key rule: Internal-control and security needs are requirements like any other; the later in development a requirement is added, the more rework it causes.
System Development Technology · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.