11.11

Control Activities

Principle 11 - Design General Control Activities over Information Technology

Attribute 11.11 - Logical and physical access control activities include restricting access or detecting inappropriate access to information and information technology. They protect information technology resources against unauthorized access, use, disclosure, disruption, modification, or destruction, whether from malicious intent or error. Logical access control activities require users to authenticate themselves and restrict them to the applications or functions commensurate with their assigned responsibilities, supporting an appropriate segregation of duties. Management may grant different permissions to employees and end users, including the rights to create, read, edit, or delete a file; execute a program; and retrieve or update information in a database. Management designs other control activities to promptly update access rights when employees change job functions or leave the entity. Physical access control activities involve restricting physical access to information and information technology, including the physical infrastructure, and protecting it from intentional or unintentional loss or impairment.

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute - 11.10
• Next Attribute - 11.12

Jamie's Story

No examples are available to illustrate governance gaps for this attribute.

Election Anomalies

Arizona Senate Allegations

Arizona Senate allegations arose from MC's failure to recognize the Arizona Senates Oversight Role. These allegations were investigated and reported on by the Arizona Attorney General's Office 2020 General Election Investigation. This Green Book attribute applies given the Arizona Senate's concern that the 2020 election results may have been fraudulently reported,

• Maricopa Election Management Server (2020)
  • MC EMS 2020 - Election Management System Database Purged
    • The status of this allegation was left as indeterminate by the AZ AG's inspector.
  • MC EMS 2020 - Election Files Deleted
    • The status of this allegation was left as indeterminate by the AZ AG's inspector.
  • MC EMS 2020 - Corrupt Ballot Images
  • The status of this allegation was left as indeterminate by the AZ AG's inspector.
  • MC EMS 2020 - Missing Ballot Images
  • The status of this allegation was left as indeterminate by the AZ AG's inspector.
  • MC EMS 2020 - Failure to Follow Basic Cyber Security Practices
    • MC leadership claimed two-people are required to ensure access to the EMS server as a security measure to prevent fraudulent access. This appears as a deterrent. However, this risk prevent measure is less than is required to pick up early ballots from a drop box. Two-people, each from a different political party are required to pick up early ballots from a drop box as reported in the Maricopa Dropbox Collection (2020) allegation. More personnel security is applied to drop boxes than the EMS server and a single drop box collection is just a tiny fraction of the over 1.9 million voting results residing in the EMS server.
    • The AZ AG's inspector did not mention any entry and exit logs, to record specific individulas that had access to the EMS server.
    • MC leadership also claimed that 24-hour surveillance cameras ensured restricted access. However, the AZ AG inspector was apparently not granted access to the digital recordings of the surveillance camera(s). The digital recordings are probably overwritten periodically to save memory. Hence, the presents of the 24-hour cameras may appear as a deterrent, but would be of no value for investigative purposes after the suspected timeframe is overwritten with new data.
  • MC EMS 2020 - Subpoenaed Equipment Not Yet Provided
    • This was resolved through litigation. MC leadership was not willingly sharing data with the Arizona Senate. The lack of transparency suggests something to hide to an observant Public
  • MC EMS 2020 - Anonymous Logins
    • The status of this allegation was left as indeterminate by the AZ AG's inspector.
  • MC EMS 2020 - Dual Boot System Discovered
    • The status of this allegation was left as indeterminate by the AZ AG's inspector.
  • MC EMS 2020 - Operating System Logs Not Preserved
    • The status of this allegation was left as indeterminate by the AZ AG's inspector.
  • MC EMS 2020 - Internet Connections to the EMS