Title: Internal Control Strategies
Course: IN 2001 Principle of Information Assurance > Section: Module 11: Chapter 11

Internal Control Strategies
1. Separation of duties is a cornerstone in the protection of information assets and in preventing loss.
2. The completion of a significant task that involves sensitive information should involve two people.
3. If one person has the authorization to access a particular set of information, there may be nothing to prevent this individual from copying it and removing it from the premises.
4. The checks and balances method requires two or more people to work together to complete a task and is designed to reduce the risk of collusion—that is, of unscrupulous workers conspiring to commit an unauthorized task.
5. The odds of two people being willing and able to misuse or abuse the system are much lower than that of one.
6. Related to the concept of separation of duties is that of two-man control, the requirement that two individuals review and approve each other’s work before the task is categorized as finished.
7. This is different from separation of duties, in which the two people work in sequence.  In two-man control, each person completely finishes the necessary work and then submits it to the other coworker.
8. Each coworker examines the work performed, double-checks the actions performed and makes sure no errors or inconsistencies exist.
9. Another control used to prevent personnel from misusing information assets is job rotation or task rotation, the requirement that every employee be able to perform the work of another employee.
10. Ensuring that all critical tasks can be performed by multiple individuals greatly increases the chance that one employee will be able to detect when another employee misuses or abuses information or the system.
11. A mandatory vacation of at least one week provides the ability to audit the work of an individual.
12. Individuals who are stealing or misusing information or systems are reluctant to take vacations because they are afraid that their actions will be detected while they are away.
13. Employees should be provided access to the minimal amount of information for the minimal amount of time necessary for them to perform their duties.
14. Similar to the concept of need-to-know, least privilege ensures that no unnecessary access to data exists and that only those individuals who must access the data do so.
15. The whole purpose of information security is to allow those people with a need to use information to do so without being concerned about the system’s ability to maintain the confidentiality, integrity and availability of the information.
16. Everyone who can access data probably will, and such a situation could have devastating consequences on the organization’s information security.