@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix edu: <https://knobit.org/def/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix schema: <https://schema.org/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

<https://knobit.org/id/task/dsec-access-design/I3> a edu:Question ;
    rdfs:label "I3 (1.5 points)"@en ;
    dcterms:license <https://creativecommons.org/licenses/by/4.0/> ;
    owl:sameAs <https://bitbucket.org/reffa/ontology/id/task/dsec-access-design/I3> ;
    schema:hasPart <https://knobit.org/id/register/data-security#SE-361>,
        <https://knobit.org/id/register/data-security#SE-362>,
        <https://knobit.org/id/register/data-security#SE-363> ;
    schema:identifier "I3" ;
    schema:position 5 ;
    schema:text "Integrity and emergency access, 0.5 each. (a) RL-011 holds edit_case, which updates amount_due and days_past_due loaded from core banking; no duty needs it, and a collector could lower a debt or reset the days past due: removed, with the integrity risk named and not only the excess. (b) Part A's crud matrix gives each job the operations its duties need: JB-010 reads but does not update arrears_case; JB-012 reads and writes hardship_note; JB-010, JB-011, JB-013 and JB-014 have no operation on hardship_note. (c) BG-010 is granted by the Service Desk on a phone call: anyone who can pass as the on-call engineer talks their way into DBA rights (social engineering, vishing). The grant is tied to a verified request - an authenticated ticket, a second approver or a call-back to a number from the HR directory - with expiry and CISO review kept."@en .

edu:Question rdfs:label "Question"@en,
        "Küsimus"@et .

<https://knobit.org/id/register/data-security#SE-361> rdfs:label "dsec-access-design I3: collectors can change amounts loaded from core banking"@en .

<https://knobit.org/id/register/data-security#SE-362> rdfs:label "dsec-access-design I3: a CRUD matrix of jobs against the collections tables"@en .

<https://knobit.org/id/register/data-security#SE-363> rdfs:label "dsec-access-design I3: break-glass granted on an unverified phone call"@en .