Which concept involves dividing responsibilities to reduce fraud risk?

Which concept involves dividing responsibilities to reduce fraud risk?

• A. RBAC
• B. Security Labels
• C. Separation of Duties
• D. Transaction-based Rights

Answer: (C)

Separation of duties is the practice of dividing responsibilities among individuals so that no single person can complete all steps of a critical process. This creates checks and balances that make fraud and errors much harder to conceal, because one person’s work is reviewed or overseen by someone else. In practice, this means splitting key tasks like initiating a request, approving a change, and provisioning access among different people. For example, the person who requests user access should not be the same person who approves it or assigns the permissions. This concept also fits with role-based access control: you can design roles so that conflicting permissions aren’t held by the same individual, enforcing SoD within the access model. The other options don’t describe this control. Security labels deal with data classification and access decisions, not who performs or reviews processing steps. Transaction-based rights describe permissions tied to specific transactions rather than the separation of duties. RBAC is the broader model for assigning permissions, while separation of duties is the governance control that prevents a single actor from having too much power.

Separation of duties is the practice of dividing responsibilities among individuals so that no single person can complete all steps of a critical process. This creates checks and balances that make fraud and errors much harder to conceal, because one person’s work is reviewed or overseen by someone else.

In practice, this means splitting key tasks like initiating a request, approving a change, and provisioning access among different people. For example, the person who requests user access should not be the same person who approves it or assigns the permissions. This concept also fits with role-based access control: you can design roles so that conflicting permissions aren’t held by the same individual, enforcing SoD within the access model.

The other options don’t describe this control. Security labels deal with data classification and access decisions, not who performs or reviews processing steps. Transaction-based rights describe permissions tied to specific transactions rather than the separation of duties. RBAC is the broader model for assigning permissions, while separation of duties is the governance control that prevents a single actor from having too much power.