@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix edu: <https://knobit.org/def/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix schema: <https://schema.org/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

<https://knobit.org/id/task/dsec-access-design/I2> a edu:Question ;
    rdfs:label "I2 (2.5 points)"@en ;
    dcterms:license <https://creativecommons.org/licenses/by/4.0/> ;
    owl:sameAs <https://bitbucket.org/reffa/ontology/id/task/dsec-access-design/I2> ;
    schema:hasPart <https://knobit.org/id/register/data-security#SE-356>,
        <https://knobit.org/id/register/data-security#SE-357>,
        <https://knobit.org/id/register/data-security#SE-358>,
        <https://knobit.org/id/register/data-security#SE-359>,
        <https://knobit.org/id/register/data-security#SE-360> ;
    schema:identifier "I2" ;
    schema:position 4 ;
    schema:text "The outsourced agency's access, 0.5 each. (a) RL-016's row filter keys on agency_ref, which the agency itself loads through its daily status upload, so the agency can widen its own rows: the filter is keyed on arrears_case.assigned_agency_id (set by team leads from the vendor register) or on the user's organisation from the bank's identity directory. (b) RL-016 is one login shared by all agency staff with the go-live password never changed: personal named accounts per agency user (with MFA), the shared password gone. (c) FW-207 opens the internal portal server col-portal-01 to any internet address: the portal is reached only through a DMZ or reverse proxy, with a VPN or an address allowlist for Northcoll. (d) TR-001 goes by e-mail with the zip password in the same e-mail: replaced by encryption the e-mail cannot undo - the file encrypted with Northcoll's public key (PGP) and/or delivered over SFTP or TLS. (e) Contract C-77 has no security terms: the answer reports that the bank stays accountable for outsourced processing and asks for security obligations, an audit right and breach notification in the contract."@en .

edu:Question rdfs:label "Question"@en,
        "Küsimus"@et .

<https://knobit.org/id/register/data-security#SE-356> rdfs:label "dsec-access-design I2: the agency row filter keyed on a value the agency loads"@en .

<https://knobit.org/id/register/data-security#SE-357> rdfs:label "dsec-access-design I2: a shared agency login with the go-live password"@en .

<https://knobit.org/id/register/data-security#SE-358> rdfs:label "dsec-access-design I2: an internal portal server open to the internet"@en .

<https://knobit.org/id/register/data-security#SE-359> rdfs:label "dsec-access-design I2: the agency file and its password in the same e-mail"@en .

<https://knobit.org/id/register/data-security#SE-360> rdfs:label "dsec-access-design I2: an outsourcing contract with no security terms"@en .