Practice 8: Enforce Separation of Duties and Least Privilege

Separation of duties and least privilege must be implemented in business processes and for technical modifications to critical systems or information to limit the damage that malicious insiders can inflict.

What Can You Do?

Separation of duties requires dividing functions among people to limit the possibility that one employee could steal information, commit fraud, or commit sabotage without the cooperation of another. One type of separation of duties, called the two-person rule, is often used. It requires two people to participate in a task for it to be executed successfully. The separation of duties may be enforced via technical or nontechnical controls. Examples include requiring two bank officials to sign large cashier’s checks, or requiring verification and validation of source code before the code is released operationally. In general, employees are less likely to engage in malicious acts if they must collaborate with another employee.