During a recent penetration testing engagement for a financial firm, you discovered that an employee's credentials were used to access sensitive client data during a time when the employee was on a mandatory vacation. This finding should prompt which of the following recommendations in your final report?
You selected this option
Advise additional system hardening techniques to ensure that the employee’s credentials cannot be misused during their mandatory vacation period.
You selected this option
Propose enhanced user training focused on security best practices to prevent employees from sharing their credentials.
You selected this option
Recommend reinforcing the use of mandatory vacations as an operational control, along with auditing account activity during such periods to uncover potential unauthorized access or internal threats.
You selected this option
Suggest implementing job rotation so that no single employee has exclusive access to sensitive client data for an extended period.
The correct answer involves implementing mandatory vacations as an operational control. Mandatory vacations can potentially reveal fraudulent activities and are part of a good security strategy, as unauthorized access during an employee's absence may indicate account misuse or compromise. Mentioning system hardening ignores the operational control aspect related to employee absence. While job rotation is an operational control, it does not directly address the issue of detecting unauthorized access during an employee's absence. Similarly, user training is always beneficial but does not directly relate to the specific situation presented in the question.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are operational controls in a security context?
Open an interactive chat with Bash
How do mandatory vacations help in detecting fraud?
Open an interactive chat with Bash
What are some other internal controls to consider for securing sensitive data?