2 cissp ® Official Study Guide Eighth Edition

The Importance of Job Descriptions
Job descriptions are important to the design and support of a security 
solution. However, many organizations either have overlooked this or 
have allowed job descriptions to become stale and out-of-sync with 
reality. Try to track down your job description. Do you even have one? If 
so, when was it last updated? Does it accurately reflect your job? Does it 
describe the type of security access you need to perform the prescribed 
job responsibilities? Some organizations must craft job descriptions to 
be in compliance with Service Organization Control (SOC) 2, while others 
following ISO 27001 require annual reviews of job descriptions.
Important elements in constructing job descriptions that are in line with organizational 
processes include separation of duties, job responsibilities, and job rotation. 
Separation of Duties
Separation of duties
is the security concept in which critical, sig-
nifi cant, and sensitive work tasks are divided among several individual administrators or 
high-level operators (Figure 2.1 ). This prevents any one person from having the ability 
to undermine or subvert vital security mechanisms. Think of separation of duties as the 
application of the principle of least privilege to administrators. Separation of duties is also 
a protection against collusion.
Collusion
is the occurrence of negative activity undertaken 
by two or more people, often for the purposes of fraud, theft, or espionage. By limiting the 
powers of individuals, separation of duties requires employees to work with others to com-
mit larger violations. The act of fi nding others to assist in a violation and then the actions 
to perform that violation are more likely to leave behind evidence and be detectible, which 
directly reduces the occurrence of collusion (via deterrence, the chance that they might get 
caught). Thus, collusion is diffi cult and increases risk to the initiator prior to the commis-
sion of the act. 

---

Personnel Security Policies and Procedures 
53
F I g u R e 2 .1
An example of separation of duties related to five admin tasks and seven 
administrators
Admin
Tasks
Database
Management
Firewall
Management
User
Account
Management
File
Management
Network
Management
Admin 1
Admin 2
Admin 3 & 4
Admin 5
Admin 6 & 7
Assigned
to
Admins