Section: Protection of Information Assets
Explanation:
Piggybacking refers to unauthorized persons following authorized persons, either physically or virtually, into
restricted areas. This policy addresses the polite behavior problem of holding doors open for a stranger, if
every employee must have their badge read at every controlled door no unauthorized person could enter
the sensitive area. Looking over the shoulder of a user to obtain sensitive information could be done by an
unauthorized person who has gained access to areas using piggybacking, but this policy specifically refers
to physical access control. Shoulder surfing would not be prevented by the implementation of this policy.
Dumpster diving, looking through an organization's trash for valuable information, could be done outside
the company's physical perimeter; therefore, this policy would not address this attack method.
Impersonation refers to a social engineer acting as an employee, trying to retrieve the desired information.
Some forms of social engineering attacks could join an impersonation attack and piggybacking, but this
information security policy does not address the impersonation attack.

It is critical to initially identify information assets that can be made more resilient to disasters, e.g., diverse routing, alternate paths or multiple communication carriers. It is impossible to remove all existing and future threats. The optimization of the recovery time objective and efforts to minimize the cost of recovery come later in the development of the disaster recovery strategy.

Post-implementation testing is the process of verifying and validating the functionality, performance, and security of a system after it has been deployed to the production environment1. Post-implementation testing is important for ensuring that the system meets the user requirements and expectations, as well as the operational and business objectives. Post-implementation testing also helps to identify and resolve any defects, errors, or issues that may have occurred during the deployment process or that may have been missed during the previous testing stages2.
Therefore, the observation that post-implementation testing is not conducted for all system releases should be of greatest concern to an IS auditor performing an audit of change and release management controls for a new complex system developed by a small in-house IT team. This observation indicates that the system may have quality, reliability, or security problems that could affect the user satisfaction, system performance, or data integrity. This observation also suggests that the change and release management controls are not adequate or effective, as they do not ensure that all system releases are properly tested and validated before and after deployment.
Option A is not correct because access to change testing strategy and results is not restricted to staff outside the IT team is not a major concern for an IS auditor. While it is good practice to limit access to sensitive or confidential information, such as test data or test cases, to authorized personnel only, access to change testing strategy and results may not pose a significant risk to the system or the organization. Moreover, access to change testing strategy and results may be beneficial for some stakeholders outside the IT team, such as business users, project managers, or auditors, who may need to review or evaluate the testing process or outcomes.
Option B is not correct because some user acceptance testing (UAT) was completed by members of the IT team is not a major concern for an IS auditor. User acceptance testing is the process of verifying and validating that the system meets the user requirements and expectations by involving actual or representative users in the testing process3. While it is preferable to have independent and unbiased users perform UAT, it may not be feasible or practical for some organizations, especially those with small or limited resources. Therefore, some UAT may be completed by members of the IT team, as long as they have sufficient knowledge and experience of the user needs and expectations, and as long as they follow the UAT plan and criteria.
Option C is not correct because IT administrators have access to the production and development environment is not a major concern for an IS auditor. IT administrators are responsible for managing and maintaining the IT infrastructure, including the production and development environments4. Therefore, it is reasonable and necessary for them to have access to both environments, as long as they follow the appropriate policies and procedures for accessing, using, and securing them. Moreover, IT administrators may need to perform tasks such as backup, restore, patching, or troubleshooting in both environments.
References:
* What Is Post Implementation Testing?1
* Post Implementation Review (PIR) - Definition & Process2
* User Acceptance Testing (UAT): Definition & Examples3
* What Is an IT Administrator? Definition & Examples4

Section: Protection of Information Assets
Explanation:
Most encrypted transactions use a combination of private keys, public keys, secret keys, hash functions
and digital certificates to achieve confidentiality, message integrity and nonrepudiation by either sender or
recipient. The recipient uses the sender's public key to decrypt the prehash code into a posthash code,
which when equaling the prehash code, verifies the identity of the sender and that the message has not
been changed in route; this would provide the greatest assurance. Each sender and recipient has a private
key known only to themselves and a public key, which can be known by anyone. Each encryption/
decryption process requires at least one public key and one private key, and both must be from the same
party. A single, secret key is used to encrypt the message, because secret key encryption requires less
processing power than using public and private keys. A digital certificate, signed by a certificate authority,
validates senders' and recipients' public keys.