The Security Risk Assessment Handbook, 2nd Edition

Technical Data Gathering  ◾  245

© 2011 by Taylor & Francis Group, LLC

◾ Accountability—e principle of accountability states that the additions,

modications, and deletions of critical assets need to be audited and associ-

ated with the user or process that performed the action. For each critical asset

within a critical system, an audit record should be cut when the le is viewed,

deleted, modied, or created.

e security risk assessment team should ensure that adequate audit

records are generated for access to critical assets.

◾ Avoid Single Points of Failure—A single point of failure is dened as a

resource whose loss will in turn result in the loss of a critical service. If a

single system component or resource fa