ISC2 Certified in Cybersecurity (CC)Network SecurityHard
A security auditor is examining a company's remote access solution. They discover that employees are using a generic, shared username and password for connecting to the company's internal resources from outside the network. Which security best practice is being violated, and what is the primary risk?
- ALack of Multi-Factor Authentication (MFA); increased risk of brute-force attacks.
- BLack of Unique User Identification; difficulty in accountability and incident tracing.
- CLack of Strong Password Policy; passwords are easy to guess.
- DLack of Least Privilege; employees have excessive access permissions.
Show answer & explanationAnswer & explanation
Correct answer: B. Lack of Unique User Identification; difficulty in accountability and incident tracing.
Using a generic, shared username prevents unique identification of individual users. This violates the principle of unique user identification, making it impossible to hold specific individuals accountable for their actions and significantly hindering incident tracing and forensic investigations.
Why the other options are wrong
- A. While MFA is a best practice, the core issue described is shared credentials, not necessarily the lack of a second factor, and the primary risk is not just brute-force but accountability.
- C. While strong passwords are important, the primary issue is the *sharing* of credentials, regardless of their strength, as it compromises unique identification.
- D. Least Privilege relates to access permissions *after* authentication, not the authentication method itself. The problem is identifying *who* authenticated.
Unique User Identification
The practice of assigning a distinct and non-reusable identifier to each individual user accessing a system or network resource.
- Essential for accountability and non-repudiation.
- Facilitates auditing and incident response.
- Prevents shared accounts that obscure individual actions.
Memory trick: Each person needs their own key, so we know who opened the door.