From the course: Complete Guide to Cybersecurity: A Practical Approach

Unlock this course with a free trial

Join today to access over 24,500 courses taught by industry experts.

Understanding the concept of segregation of duties

Understanding the concept of segregation of duties

From the course: Complete Guide to Cybersecurity: A Practical Approach

Understanding the concept of segregation of duties

- [Presenter] A core element of authorization is the principle of segregation of duties. This is also known as separation of duties. Segregation of duties is based on the security practice that no one person should control an entire high-risk transaction from start to finish. It basically breaks the transaction into separate parts. Then it requires that a different person execute each part of that transaction. A very good example of this is whenever an employee may actually submit an invoice payment to a vendor or for reimbursement to themselves, but it must be approved by a manager prior to payment. Another example is that pretty much anybody can submit a change to a system configuration, but that request should go through a lot of technical and management review processes and then gain approval before, of course, it can be implemented. The main concept is to prevent fraud or to detect an error in the process or in the case of incited threat. Now, of course, there's always a chance…

Contents