I'm kind of surprised that Citibank had such weak internal controls on their network configuration. On the other hand, internal controls are not free. Separatio

I'm kind of surprised that Citibank had such weak internal controls on their network configuration. On the other hand, internal controls are not free. Separation of duties and the two person rule are expensive in manpower and coordination of larger teams. It would appear that whoever accepted the risk of the network internal controls at Citibank, lost that gamble.