A university issues badges through a homegrown identity management system to all staff and
students. Each week during the summer, temporary summer school students arrive and need to
be issued a badge to access minimal campus resources. The security team received a report
from an outside auditor indicating the homegrown system is not consistent with best practices in
the security field and leaves the institution vulnerable.
Which of the following should the security team recommend FIRST?
A. Investigating a potential threat identified in logs related to the identity management system
B. Updating the identity management system to use discretionary access control
C. Beginning research on two-factor authentication to later introduce into the identity management
system
D. Working with procurement and creating a requirements document to select a new IAM
system/vendor