u Segregation of duties was not enforced—the same individuals were
functioning both as programmers and security administrators.
u Security exposures were created by inadequate system software
maintenance procedures, such as allowing uncontrolled insertions of