Information Systems Control Design Flashcards

Which control design principle ensures that no single individual can complete a sensitive transaction without involvement of another person?

Answer: Segregation of duties

Segregation of duties divides critical tasks among multiple people, preventing any single person from committing and concealing fraud or error.

The principle of least privilege in access control design means that users should be granted:

Answer: Only the minimum permissions needed to perform their job functions

Least privilege limits each user's access to only what is required for their role, reducing the attack surface if credentials are compromised.

Defense in depth is a control design strategy that involves:

Answer: Layering multiple controls so that failure of one does not expose the entire system

Defense in depth uses multiple overlapping controls so that if one layer fails, subsequent layers still protect the asset.

Which control objective is MOST directly supported by implementing input validation in a web application?

Answer: Preventing injection attacks and data integrity violations

Input validation prevents malicious inputs (e.g., SQL injection, XSS) from compromising data integrity or allowing unauthorized system access.

When designing controls for a high-risk IT process, which approach provides the GREATEST assurance?

Answer: Implementing both preventive and detective controls in combination

Combining preventive controls (to stop threats) with detective controls (to catch what gets through) provides layered assurance for high-risk processes.

A control that automatically locks a user account after five failed login attempts is BEST classified as:

Answer: Preventive technical control

An account lockout policy is a preventive technical control that automatically blocks brute-force login attempts.