Which of the following is the MOST effective control to mitigate against the risk of inappropriate activity by employees?

User activity monitoring is a detective control that directly addresses the risk of inappropriate actions by logging and reviewing what employees do with their authorized access. This visibility acts as a powerful deterrent, discouraging the misuse of privileges. It allows for the timely detection of policy violations or malicious behavior by legitimate users, making it the most effective control listed for mitigating the risk of an employee's inappropriate activity. While preventive controls are essential, they do not stop an authorized individual from misusing their legitimate access.

B. Two-factor authentication: This control verifies user identity but does not prevent a legitimately authenticated user from performing inappropriate actions with their granted privileges.

C. Network segmentation: This limits the scope of potential damage by containing activity within a network segment but does not monitor or prevent inappropriate actions within that segment.

D. Access recertification: This is a periodic review to remove excessive privileges. It does not provide real-time mitigation or detection of inappropriate activity occurring between review cycles.

---

1. ISACA CISA Review Manual

27th Edition. Domain 4: Information Systems Operations

Section 4.4

"Monitoring and Reporting." This section emphasizes that monitoring system and user activities is critical for detecting unauthorized actions

policy violations

and security incidents. It states

"Monitoring allows an organization to identify potential security incidents in a timely manner... Examples of monitoring include reviewing access logs

security event logs and system configuration changes." This directly supports monitoring as the primary control for overseeing user activity.

2. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM

18(7)

387-408. This foundational academic paper on computer security outlines design principles. The principle of "Complete Mediation" (Section I.A.3) implies that every access must be checked

and the principle of "Auditing" (implied through logging and monitoring) is necessary to detect when controls are bypassed or misused. It establishes that access decisions (preventive) are separate from reviewing the actions taken (detective)

with the latter being crucial for accountability. (DOI: https://doi.org/10.1145/361011.361062)

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security

Fall 2014. Massachusetts Institute of Technology. Lecture 10

"Auditing and Intrusion Detection." The lecture notes distinguish between access control mechanisms (preventive) and auditing/logging (detective). It is explained that while access control enforces policy

auditing is required to detect and investigate policy violations or misuse of privileges by authorized users

which directly aligns with mitigating the risk of "inappropriate activity."