Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Maybe I'm misunderstanding something here.
Dual Control:
Actions taken by different operators to affect a change.
Split Knowledge:
Information needed to affect a change is split between different operators.
If I have split knowledge, I must have at least 2 operators.
It follows that I must have actions take by different operators to use the information ergo dual control.
So if this is right: Can split knowledge always be considered more secure than dual control?
Not sure that "more secure" would be an accurate assessment of the two. Both of these are examples of separation of duties and both implementations require more than one administrator to perform the task. If the task requires more than one administrator does it really make it more secure if one doesn't have the knowledge to perform the other half of that task? From a corporate administration standpoint it's actually more risky to have only one person that can perform the task (all your eggs in one basket). One could argue that dual control could actually be more secure since both admins have knowledge of the task and can perform validation of the steps taken during the task and correct errors before they happen. Once again I would say it's not so much of a "one implementation is more secure than another" as it is just different ways to enforce separation of duties.
