{"id":32336,"date":"2021-01-16T11:48:08","date_gmt":"2021-01-16T11:48:08","guid":{"rendered":"https:\/\/www.testpreptraining.com\/tutorial\/?page_id=32336"},"modified":"2021-01-16T11:48:09","modified_gmt":"2021-01-16T11:48:09","slug":"separation-of-duties-sod","status":"publish","type":"page","link":"https:\/\/www.testpreptraining.ai\/tutorial\/separation-of-duties-sod\/","title":{"rendered":"Separation of duties (SoD)"},"content":{"rendered":"\n

Go back to GCP Tutorials<\/a><\/strong><\/p>\n\n\n\n

In this tutorial, we will learn and understand about Separation of duties (SoD).<\/p>\n\n\n\n

However, Separation of duties is the concept of ensuring that one individual does not have all necessary permissions to be able to complete a malicious action. In Cloud Key Management Service, this could be an action such as using a key to access. And also decrypting data which user have no access to. Further, Separation of duties is a business control that works for larger organizations. As this helps to avoid security or privacy incidents and errors. <\/p>\n\n\n\n

\"gcp<\/a><\/figure><\/div>\n\n\n\n

Setting up Cloud KMS in a separate project<\/strong><\/h4>\n\n\n\n

Cloud KMS can run in an existing project, for example your-project. And this might be sensible if the data being encrypted with keys in Cloud KMS is stored in the same project. However, any user with owner access on that project is then also able to manage keys in Cloud KMS in that project. This is because the projects owns the keys themselves, of which the user is an owner.<\/p>\n\n\n\n

Instead, to allow for a separation of duties, you could run Cloud KMS in its own project, for example your-key-project. Then, depending on the strictness of your separation requirements, you could either:<\/p>\n\n\n\n