The Shared Drive That Outgrew Its Owner
Meridian Logistics has 1,400 staff and one information security manager, Priya, who reports to the IT director. A routine access review shows that the finance shared drive holds 90,000 files, of which 38,000 are readable by the entire company because a legacy 'All Staff' group was granted modify rights in 2016. The same drive stores payroll data and the contract archive. Priya has no budget line of her own; her requests are funded case by case by the IT director, who is also accountable for the availability of the file server. When Priya raises the exposure, the IT director says the business will not tolerate a change freeze before the peak shipping season, which begins in nine weeks. The CEO has publicly stated that 'security is everyone's responsibility' but has never chaired a risk discussion.
1. Identify the governance weaknesses in this situation and explain why Priya cannot resolve the exposure through technical action alone.
Read the worked answer
The core weakness is unclear ownership and accountability. Priya is named information security manager but has no budget, no authority to impose a change freeze, and no reporting line that reaches the CEO directly. The IT director simultaneously funds security work and owns the availability of the asset in question, so every control Priya proposes is judged against his operational targets. That is a conflict of interest in the decision-making structure, not a personality problem.
Second, the risk appetite has never been expressed. The CEO's statement that 'security is everyone's responsibility' is a slogan, not a direction. Nobody has said whether a 38,000-file exposure of payroll data is tolerable for nine weeks. Without that statement, Priya and the IT director are each guessing, and the person with budget control wins by default.
Third, there is no risk acceptance route. If the business genuinely cannot absorb a change freeze before peak season, the correct outcome is a documented, time-bound acceptance signed by an accountable executive, with compensating controls. Instead the decision is being made informally in conversation.
Technical action alone cannot fix this because the fix requires someone with authority to accept short-term operational pain (a freeze, a migration, a re-permissioning project) in exchange for reduced risk. Priya can execute; she cannot authorise. The remedy is structural: a named information asset owner for the finance drive, a written risk appetite statement, and a reporting line or steering committee where security risk is tabled alongside operational risk with the CEO or a delegated executive in the chair.
2. The IT director offers a compromise: keep the current permissions but add monitoring that alerts when 'All Staff' users open payroll files. Assess this proposal.
Read the worked answer
Monitoring is a detective control, and it is worth having, but it does not address the exposure. The legacy group still has modify rights, so the risk is not only unauthorised reading but alteration or deletion of payroll and contract records. An alert after the fact does not prevent a malicious insider from copying a file, and it does not prevent accidental damage.
Assess it against the actual risk: what is the likelihood and impact of a staff member browsing payroll data? Likelihood is high because 1,400 people have legitimate-looking access and no barrier; impact includes a personal-data breach with regulatory notification duties and possible contract loss. A detective control with no preventive layer leaves both likelihood and impact essentially unchanged.
A fair evaluation would ask three questions. Does the monitoring cover the modify rights, or only reads? Who triages the alerts, given Priya is a team of one? And what is the false-positive volume across 38,000 files? If nobody is resourced to act on alerts, the control exists on paper only.
A better compromise keeps the spirit of the offer while reducing risk: remove modify rights from 'All Staff' immediately (a narrow, low-disruption change that does not require a full freeze), keep read access temporarily for a defined subset, add monitoring as a backstop, and set a dated migration to a properly permissioned location. That gives the IT director his nine weeks while converting an open-ended exposure into a bounded, monitored one. The key judgement is to separate the cheap preventive fix from the expensive one, rather than trading both away.