Identities (users) have been provisioned with access to assets which breaches a segregation of duties requirement

Identities (users) have been provisioned with access to assets which breaches a segregation of duties requirement

Context and Guidance: Segregation of duties is an important access control principle designed to prevent identities (users) from bypassing validation and verification checks when performing actions, and significantly limits the potential for unauthorised activity.

Segregation of duty violations must be identified and mitigated, given the increased risk that they present to business activities.

Example activities that indicate this Anti-Pattern is Present include:

• if an identity (user) has the ability to both create and approve a request for access to assets (such as networks, systems, and applications), or;
• if an employee has the ability to request and approve a configuration change to a critical asset. For both of these examples, segregation of duties would suggest that another employee or process be inserted between the create/request and approve actions to ensure that there has been sufficient oversight.