Internal Controls 10 marks a. Why should an organisation use both authentication and authorisation? In your answer, provide an example of each. (3 marks) b. For each of the following identified threats, recommend one (1) preventative control which could be implemented to best mitigate the identified threat. Explain why you have chosen each of these controls. (3 marks) i. Jane had worked in account payable and Lock 'Em Out Pty Ltd for eight (8) years and was quite familiar with the system. She had been there longer than her supervisor and he relied on her experience on a day to day basis. Jane often asked the supervisor to authorise transactions, as such Jane had an idea of his password. As the supervisor was particularly busy with end of month reporting, Jane did not want to bother him, so she tried entering his password and found it was correct. ii. Julia received an email with some holiday pictures from someone she had travelled with overseas. When she opened the photos, her work laptop was infected with a keystroke logger. iii. Alex was conducting some routine maintenance to the company's website and discovered an external actor had hacked into the company's website. He could not remember who he should contact to deal with this situation and consequently spent over 40 minutes placing phone calls to numerous personnel until he located the right person