Reference no: EM133418758

Question: How would you control for the conduct failure that occurred? Can you suggest a means of monitoring to improve these controls?

You can speak briefly on the following points in your discussion:

Analysis: Is it possible to improve on the existing controls (the established security system and staff training) to prevent unwanted access and card skimming?

Ethics: How do you feel about refusing to help a person in need with a minor and seemingly harmless request? How would you balance the needs of the organisation with those of human beings?

Reporting: Which stakeholders should be informed and consulted regarding such an incident? How would you report the event to these stakeholders?

Implementation: Can you suggest any further controls that may be useful in managing this risk? How could these then be monitored to ensure they are performing as intended?

Kimi is a compliance officer who has been asked to stress test an organisation that has just implemented a new access control solution. Employees, security officials, and custodial staff have recently been issued access cards. The cards are used for physical movement within the premises and access to printing services. All employees have been trained on the new access control processes and systems.

How can Kimi circumvent these controls as part of a stress test?

First, Kimi hires a pregnant actress to request a visitors' access card from the front desk security officer so that she can use the bathroom facilities that are behind an access-controlled turnstile. The security guard does not know how to program the card correctly, so he lets her use his card. However, Kimi has given the actress a card skimmer, which she used to copy the security guard's access card.

Kimi uses the cloned card to enter the building. Because security officials typically have access cards that allow access throughout entire premises, Kimi is able to gain sensitive information simply by walking around and taking photos after most employees leave work in the evening.

She notes that some staff members have written their new passwords on sticky notes placed in accessible areas (such as on a work-station monitor, or under a keyboard). This allows Kimi to employ an ethical hacker to access the data systems and copy valuable personal information and intellectual property.