A financial institution discovers that an employee altered transaction logs to conceal fraudulent fund transfers. Identify the primary component of the CIA triad compromised by altering the logs, and explain how each of the following controls mitigates this insider threat: (1) least privilege access controls, (2) cryptographic hashing or write-once storage, and (3) separation of duties.

Question

Accepted Answer

1. Primary Compromised Pillar: Integrity is directly compromised because the historical records were modified without authorization, invalidating the accuracy and reliability of the audit logs.

2. Mitigation Controls:
- Least Privilege Access Controls: Restricts write and delete permissions so that general employees and transaction processors cannot modify or erase audit logs, allowing log append/write operations only to automated logging services.
- Cryptographic Hashing / Write-Once Storage: Cryptographic hashes (e.g., hash chains) make unauthorized changes immediately detectable by altering digest values, while Write-Once-Read-Many (WORM) storage physically prevents log modification or deletion once written.
- Separation of Duties: Ensures that individuals authorized to execute financial transactions do not hold administrative access over auditing and logging systems, preventing a single insider from committing fraud and independently concealing their actions.. ### Why this is right
The scenario describes deliberate changes to transaction logs, so the central concern is that records cannot be trusted. The supplied material names access controls, audit trails, and cryptographic checks as protections against this kind of tampering.

### The concept
An insider threat comes from someone with access inside an organization who misuses that access. Transaction logs document financial activity, so altering them can hide illicit transfers and damage confidence in the records. Access controls restrict which users may change information. Audit trails record actions for review. Cryptographic checks help detect modifications. These controls reduce or reveal tampering, but they do not make every other security impact impossible.

### What a good answer covers
- Identify log manipulation as an integrity threat.
- Explain how access controls limit unauthorized changes.
- Explain how audit trails support review of activity.
- Explain how cryptographic checks help detect tampering.
- Note that confidentiality or availability may be affected in some circumstances.

### Terms
- **Insider threat**: risk created when a person with legitimate organizational access misuses it.
- **Audit trail**: a record of actions or events that can be examined later.

### Remember
When records are manipulated to hide activity, protect both the ability to restrict changes and the ability to detect them.

Explanation

Related Questions