Separation of Duties

Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 18 of 43.

For some jobs, one person should make a request and another person should check it. For example, someone who requests a refund should not be able to approve their own refund. Splitting these jobs is called separation of duties.

Suppose Lumen uses one group for requesting refunds and another for approving them. Check who belongs to each:

seclab groups refunds

You should see:

refunds: create refund requests
  members: ava, lee

seclab groups approvers

You should see:

approvers: approve refunds
  members: lee

Lee appears in both groups, so he can request a refund and approve it himself. If Ava should request refunds and Lee should approve them, remove Lee from the requesting group:

seclab remove lee refunds

You should see:

Removed lee from refunds.

Ava can still request refunds and Lee can still approve them. The work can continue, but every request now needs another person to check it.

Challenge

Easy

Ticket from Dana, CEO

Changing a supplier's bank details and approving its payments should be two different jobs. Someone currently has access to both. I manage supplier details; Omar approves payments. Compare the groups and remove the overlap, keeping the access each of us needs for our job.

Try it yourself

Terminal

All lessons in Security Fundamentals

2Phishing

Phishing Look-Alike Domains Who Clicked The Second Wave

5Email Attacks

Reply-To Dangerous Attachments Where an Email Came From The Invoice Queue Business Email Compromise Blocking a Sender Mailbox Rules The Phishing Reports

3Access Control

Groups Least Privilege Admin Rights The New Hire Leavers Shared AccountsSeparation of DutiesThe Access Review

6Rules of the Job

Authorization No Hacking Back The Vendor's Call