Overriding Security Controls

Overriding security controls is an internal threat: someone who already has access to an organisation's systems bypasses a protection that is there to keep systems and data safe.

They may do this to reach data they are not allowed to see, because they find a control inconvenient, or because they think they know better. For example, a staff member might share an administrator password, turn off antivirus or a firewall, install software the organisation has not approved, or remove access restrictions from a folder.

How it leads to harm

Overriding a control can let malware spread or let data be accessed. If a staff member disables antivirus to install an unapproved game, malware in that game can run and encrypt files on the computer, including work documents. If a staff member removes access restrictions, other people can open files they should not see. Using an administrator password that is not yours lets you change settings and weaken security.

The user may not intend harm, but the protection is missing while they work, so the effect is still a security risk. The risk is clearest when you name the control being bypassed and explain what happens next: disabled antivirus lets malware run and encrypt work files, or removed restrictions let unauthorised staff read records.