I2 (2.5 points)
https://knobit.org/id/task/dsec-access-design/I2
Also as Turtle · JSON-LD · RDF/XML
| dcterms:license | https://creativecommons.org/licenses/by/4.0/ |
|---|---|
| owl:sameAs | https://bitbucket.org/reffa/ontology/id/task/dsec-access-design/I2 |
| rdfs:label | I2 (2.5 points) en |
| schema:hasPart | dsec-access-design I2: the agency row filter keyed on a value the agency loads |
| schema:hasPart | dsec-access-design I2: a shared agency login with the go-live password |
| schema:hasPart | dsec-access-design I2: an internal portal server open to the internet |
| schema:hasPart | dsec-access-design I2: the agency file and its password in the same e-mail |
| schema:hasPart | dsec-access-design I2: an outsourcing contract with no security terms |
| schema:identifier | I2 |
| schema:position | 4 |
| schema:text | The outsourced agency's access, 0.5 each. (a) RL-016's row filter keys on agency_ref, which the agency itself loads through its daily status upload, so the agency can widen its own rows: the filter is keyed on arrears_case.assigned_agency_id (set by team leads from the vendor register) or on the user's organisation from the bank's identity directory. (b) RL-016 is one login shared by all agency staff with the go-live password never changed: personal named accounts per agency user (with MFA), the shared password gone. (c) FW-207 opens the internal portal server col-portal-01 to any internet address: the portal is reached only through a DMZ or reverse proxy, with a VPN or an address allowlist for Northcoll. (d) TR-001 goes by e-mail with the zip password in the same e-mail: replaced by encryption the e-mail cannot undo - the file encrypted with Northcoll's public key (PGP) and/or delivered over SFTP or TLS. (e) Contract C-77 has no security terms: the answer reports that the bank stays accountable for outsourced processing and asks for security obligations, an audit right and breach notification in the contract. en |