Lion Cipher Lab
Find segregation-of-duties breaches in actual transactions
- GRC / Compliance
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Segregation of duties (SoD) means no one person can complete a sensitive process alone. The person who requests a payment is not the person who approves it. The person who changes a supplier's bank account does not also pay that supplier. NIST SP 800-53 includes it as control AC-5, Separation of Duties. Most SoD reviews check the role design: does any user hold two roles that should not be combined? A clean design is necessary, but it is not proof, because systems often allow more than the roles intend. An approver can still create a payment. An IT administrator can approve something through…
What you'll learn
- the difference between SoD by design and SoD in practice
- maker-checker (four-eyes) checks on transactions
- detecting approvals by people without the approver role
- the vendor bank-change fraud pattern
- valuing the transactions affected
- what transaction analytics cannot see (collusion)
- turning findings into preventive system controls
Steps in this lab
- Design versus practice
- The roles and the ledger
- Write the transaction checks
- Run it: a clean design and four breaches
- From detection to prevention, and the limit of it