IT Access Control, Data Integrity, and an Audit Trail Gap
A government agency's citizen-services portal has three roles: clerk (can view and edit applications), supervisor (can approve and also edit), and auditor (read-only). Logs show that on Tuesday a supervisor account approved 14 benefit applications between 02:00 and 03:30, all submitted by the same clerk. The supervisor denies working at that time. Investigation reveals: (1) supervisors and clerks shared a single generic login for after-hours work; (2) the audit log records only the account name, not the individual; (3) two of the 14 applications had bank account numbers changed minutes before approval; (4) there is no separation of duties - the same supervisor could both edit and approve. The agency must report to a regulator within 72 hours.
1. Diagnose the control failures revealed by the incident.
Read the worked answer
Control failures:
- Shared generic credentials - A single login for multiple people destroys accountability. Access control requires unique, attributable accounts; shared accounts violate the principle of individual accountability.
- Insufficient audit logging - Logging only the account name (a shared one) makes the trail useless. Logs must capture the individual, timestamp, action, and before/after values.
- No separation of duties - The same role can edit and approve, enabling fraud (edit the bank account, then approve). Editing and approving must be distinct roles.
- Anomaly detection absent - 14 approvals at 2–3 a.m. by one account should trigger alerts; none did.
- Change to bank details before approval - A high-risk change with no secondary verification.
2. What immediate containment and 72-hour reporting content should the agency prepare?
Read the worked answer
Containment (now):
- Disable the shared generic login and the implicated supervisor account; force password resets.
- Freeze the 14 applications, especially the two with changed bank details; suspend payments pending verification.
- Preserve logs and system images for forensic review (do not overwrite).
- Notify affected citizens if their data may be compromised.
72-hour regulator report should include:
- Nature of the incident (unauthorized/attributable-to-whom-unknown approvals; possible data/fund manipulation).
- Data and systems affected (applications, bank details).
- Root causes (shared credentials, weak logging, no separation of duties).
- Containment measures taken and timeline.
- Remediation plan and contact point.
Be factual; do not speculate on who acted until forensics conclude.
3. Propose the minimum remediation to prevent recurrence.
Read the worked answer
Remediation:
- Unique accounts with MFA for all staff; ban shared logins; role-based access with least privilege.
- Separation of duties - the role that edits bank details cannot approve; approval requires a different user.
- Strengthened audit logging - capture individual identity, timestamp, action, and old/new values; make logs tamper-evident and retained per policy.
- Anomaly alerts - flag after-hours bulk approvals and bank-detail changes.
- Secondary verification of bank-account changes (callback or dual approval).
- Periodic access reviews and staff training.
These directly close the four diagnosed gaps and give the regulator a credible corrective-action plan.