2 cissp ® Official Study Guide Eighth Edition

777
Monitoring and Accountability
Monitoring is a necessary function to ensure that subjects (such as users and employees) 
can be held accountable for their actions and activities. Users claim an identity (such as 
with a username) and prove their identity (by authenticating), and audit trails record their 
activity while they are logged in. Monitoring and reviewing the audit trail logs provides 
accountability for these users.
This directly promotes positive user behavior and compliance with the organization’s 
security policy. Users who are aware that logs are recording their IT activities are less likely 
to try to circumvent security controls or to perform unauthorized or restricted activities.
Once a security policy violation or a breach occurs, the source of that violation should 
be determined. If it is possible to identify the individuals responsible, they should be held 
accountable based on the organization’s security policy. Severe cases can result in terminat-
ing employment or legal prosecution.
Legislation often requires specific monitoring and accountability practices. This includes 
laws such as the Sarbanes–Oxley Act of 2002, the Health Insurance Portability and 
Accountability Act (HIPAA), and European Union (EU) privacy laws that many organiza-
tions must abide by.
monitoring activity
Accountability is necessary at every level of business, from the frontline infantry to the 
high-level commanders overseeing daily operations. If you don’t monitor the actions and 
activities of users and their applications on a given system, you aren’t able to hold them 
accountable for mistakes or misdeeds they commit.
Consider Duane, a quality assurance supervisor for the data entry department at an oil-
drilling data mining company. During his daily routine, he sees many highly sensitive 
documents that include the kind of valuable information that can earn a heavy tip or bribe 
from interested parties. He also corrects the kind of mistakes that could cause serious 
backlash from his company’s clientele because sometimes a minor clerical error can 
cause serious issues for a client’s entire project.
Whenever Duane touches or transfers such information on his workstation, his actions 
leave an electronic trail of evidence that his supervisor, Nicole, can examine in the event 
that Duane’s actions should come under scrutiny. She can observe where he obtained or 
placed pieces of sensitive information, when he accessed and modified such information, 
and just about anything else related to the handling and processing of the data as it flows 
in from the source and out to the client.
This accountability provides protection to the company should Duane misuse this infor-
mation. It also provides Duane with protection against anyone falsely accusing him of 
misusing the data he handles.

---