A manufacturing plant uses key cards to grant entry to various production areas. The security manager notices an increase in incidents where unauthorized personnel gain access by using lost or stolen key cards, even though surveillance footage shows the card being used by an individual who is clearly not the cardholder. Which of the following is the most effective administrative control to mitigate this specific vulnerability?
- AImplementing biometric authentication at entry points
- BInstalling mantraps at critical area entrances
- CUpgrading to a more secure key card technology
- DConducting regular security awareness training for employees
Show answer & explanationAnswer & explanation
Correct answer: D. Conducting regular security awareness training for employees
While technical controls like biometrics (A) or mantraps (C) would certainly enhance security, the scenario specifically describes *unauthorized individuals using stolen cards*. This points to a failure in personnel understanding and adherence to security protocols, such as not reporting lost cards immediately or not challenging unknown individuals. Regular security awareness training (B) is an administrative control that educates employees on such policies, emphasizing the importance of reporting lost cards and challenging unknown individuals, directly addressing the human element of this vulnerability. Upgrading key card technology (D) might prevent cloning but not the misuse of a physically stolen card.
Why the other options are wrong
- A. Biometric authentication is a technical control, which would be effective but is not an administrative control.
- B. Mantraps are physical controls, which would enhance security but don't directly address the administrative issue of stolen card misuse.
- C. Upgrading card technology is a technical control and may not prevent the misuse of a physically stolen card if policies are not followed.
Administrative Controls
Security controls implemented through policies, procedures, guidelines, and training to manage security risks.
- Focus on human behavior and organizational processes
- Examples: security awareness, background checks, incident response plans
- Often complement technical and physical controls
Memory trick: Controls: 'TAP' that security — Technical, Administrative, Physical.