Separation of duties and IT security

Muddied responsibilities create unwanted risk. Kevin Coleman says auditors may start labeling poorly defined IT duties as a material deficiency.

Separation of duties is a key concept of internal controls and is the most difficult and sometimes the most costly one to achieve. This objective is achieved by disseminating the tasks and associated privileges for a specific security process among multiple people.

The term SoD is already well-known in financial accounting systems. Companies in all sizes understand not to combine roles such as receiving checks (payment on account) and approving write-offs, depositing cash and reconciling bank statements, approving time cards and have custody of pay checks, etc. However, SoD is fairly new to the IT organization. It is not a surprise that concerns are being raised about separation of duties in IT given that a very high portion of SOX internal control issues come from or rely on IT. Separation of duties is a fundamental principles of many regulatory mandates such as Sarbanes-Oxley (SOX), the Gramm-Leach-Bliley Act (GLBA) and others. As a result IT organizations must now place greater emphasis on separation of duties across all IT functions, especially security.

Security Separation of Duties

Separation of duty, as it relates to security, has two primary objectives. The first is the prevention of conflict of interest, the appearance of conflict of interest, wrongful acts, fraud, abuse and errors. The second is the detection of control failures that include security breaches, information theft, and circumvention of security controls. Security controls are measures taken to safeguard an information system from attacks against the confidentiality, integrity, and availability of computer systems, networks and the data they use. In addition, the security controls are selected and applied based on a risk assessment of the information system. These controls restrict the amount of power / influence held by any one individual. Proper separation of duties, of course, is designed to ensure that individuals don't have conflicting responsibilities or is responsible for reporting on themselves or their superior.

There is an easy test for Separation of Duties. First ask if any one person alter or destroy your financial data without being detected. For the second test ask is any one person can steal or exfiltrate sensitive information. The final test asks if any one person has influence over controls design, implementation and reporting of the effectiveness of the controls. If the answer to any of these questions is YES, then you need to take a hard look at the separation of duties.

Now, as this relates specifically to security, the individual responsible for designing and implement security cannot be the same person as the person responsible for testing security, conducting security audits as well as monitoring and reporting on security. For these reasons, the reporting relationship of the individual responsible for information security should not be to the Chief Information Officer as is traditionally the case.

Page Break

Separation of duties is a common policy when people are handling money so that fraud requires collusion of two or more parties. This greatly reduces the likelihood of crime. Information should be handled in the same way. Separation of duties as it related to information systems is not just a possible Sarbanes-Oxley issue but is a requirement for PCI compliance as well. It is therefore imperative that an organization structure be design such that no individual acting alone can compromise security controls. There are five primary options for achieving separation of duties in the information security space. This list is in order of acceptability based on my experience.

  • Option 1: Have the individual responsible for information security report to CSO (chief security officer) who takes care of information security and physical security and the CSO reports directly to CEO.

  • Option 2: Have the individual responsible for information security report to Chairman of the Audit Committee.

  • Option 3: Use a third party to monitor security, surprise security audits and security testing and they report to the Board of Directors or the Chairman of the Audit Committee.

  • Option 4: Have individual responsible for information security report to the board of directors.

  • Option 5: Have the individual responsible for information security report to internal audit as long as internal audit does not report to the executive in charge of finances like the CFO.

The issue of separation of duties is growing in importance. A lack of clear and concise responsibilities for the CSO and CISO has fueled confusion. It is imperative that there be separation between operations, development and testing of security and all controls to reduce the risk of unauthorized activity or access to operational systems or data. Responsibilities must be assigned to individuals in such a way as to mandate checks and balances within the system and minimize the opportunity for unauthorized access and fraud.

Remember, control techniques surrounding separation of duties are subject to review by external auditors. Auditors have in the past listed this concern as a material deficiency on the audit report when they determine the risks are great enough. It is just a matter of time before this is done as it relates to IT security. For this reasons as well as objectivity, why not have a discussion about separation of duties as it relates to IT security with your external auditors? It can save you a lot of aggravation, cost and political infighting by getting what they view as necessary in your particular case.

Kevin G. Coleman is a fifteen year veteran of the computer industry. A Kellogg School of Management Executive Scholar, he was the former Chief strategist of Netscape. Now he is a Senior Fellow and International Strategic Management Consultant with the Technolytics Institute -- an executive think-tank. He has published over sixty articles covering security and defense related matters including UnRestricted Warfare and Cyber Warfare & Weapons. In addition he has testified before the US Congress on Cyber Security and is a regular speaker at security industry events and the Global Intelligence Summit.