Exam IIA-CIA-Part3 Topic 6 Question 67 Discussion

The issue described suggests a systemic authorization flaw, where users gain unrestricted access once logged in. This points to an improperly configured authorization system, which should enforce role-based or least-privilege access to restrict users based on their job responsibilities.
* (A) Incorrect - The authentication process relies on a simple password only, which is a weak method of authorization.
* While weak authentication is a security risk, the issue described relates to excessive access permissions, not weak login credentials.
* (B) Correct - The system authorization of the user does not correctly reflect the access rights intended.
* The problem is that users have access to all functionality, which indicates an authorization issue
, not an authentication flaw.
* Proper role-based access controls (RBAC) should limit user permissions based on job functions.
* (C) Incorrect - There was no periodic review to validate access rights.
* While periodic reviews are important for detecting unauthorized access, the issue here is a system-level authorization design flaw rather than a failure in periodic reviews.
* (D) Incorrect - The application owner apparently did not approve the access request during the provisioning process.
* Even if an access request was approved incorrectly, the broader issue remains that all users have unrestricted access, which suggests a system misconfiguration rather than a single provisioning error.
* IIA's GTAG (Global Technology Audit Guide) - Access Control and Authorization
* Emphasizes the need for role-based access control (RBAC) to prevent unauthorized access.
* COBIT Framework - IT Security Governance
* Discusses proper authorization mechanisms to align system access with business needs.
* NIST Cybersecurity Framework - Access Management Controls
* Recommends restricting access rights based on the principle of least privilege (PoLP).
Analysis of Answer Choices:IIA References and Internal Auditing Standards: