새로운 코드 개발 시 업무 분리 충돌을 보상하는 데 가장 적합한 제어 수단은 다음 중 어느 것인가?
정답: C
A post-implementation change review is the best compensating control against segregation of duties conflicts in new code development. This process involves a thorough review of the changes after they have been implemented to ensure that they meet their objectives and that the stakeholders are satisfied with the results1. It provides an opportunity to identify and correct any issues or conflicts that may have arisen during the development and implementation process. While other options like adding developers to the change approval board, limiting code deployment access to a small number of people, and creating staging environments can also serve as compensating controls, a post-implementation change review provides a more comprehensive and effective control mechanism21. References: Review and Close Change process ST 2 5 - Micro Focus Change Management for SOC: Risks, Controls, Audits, Guidance
CISA-KR 문제 617
조직의 정보 보안 정책에 대한 공식적인 검토 과정에서 발견된 다음 문제 중 조직에 가장 큰 잠재적 위험을 초래할 수 있는 것은 무엇입니까?
