A critical device is delivered with a single user and password that is required to be shared for
multiple users to access the device. An information security manager has been tasked with
ensuring all access to the device is authorized. Which of the following would be the MOST efficient
means to accomplish this?

A.
Enable access through a separate device that requires adequate authentication

B.
Implement manual procedures that require password change after each use

C.
Request the vendor to add multiple user IDs

D.
Analyze the logs to detect unauthorized access

Explanation:

Choice A is correct because it allows authentication tokens to be provisioned and terminated for
individuals and also introduces the possibility of logging activity by individual. Choice B is not
effective because users can circumvent the manual procedures. Choice C is not the best option
because vendor enhancements may take time and development, and this is a critical device.
Choice D could, in some cases, be an effective complementary control but. because it is detective,
it would not be the most effective in this instance.