CISA Certified Information Systems Auditor Study Guide

Chapter 8Identity and Access Management

THE CERTIFIED INFORMATION SYSTEMS AUDITOR (CISA) OBJECTIVES REPRESENT 26% OF THE MATERIAL COVERED ON THE EXAM AND INCLUDE:

• Domain 5: Protection of Information Assets

• A. Information Asset Security and Control
  • 1. Physical Access and Environmental Controls
  • 2. Identity and Access Management
• Supporting Tasks
  • 30. Evaluate physical and environmental controls to determine whether information assets are adequately safeguarded.
  • 31. Evaluate logical security controls to verify the confidentiality, integrity and availability of information.

The topics in this chapter and Chapter 7 combine to cover Domain 5 of the CISA exam, which represents 26 percent of the CISA examination.

Access controls are the technical, physical, and administrative methods used to control access to an information-based resource. Access controls must be actively managed by staff members who are authorized to perform this function and trained to perform it properly. In this chapter, we explore both logical and physical access controls.

Logical Access Controls

Logical access controls are used to control whether and how subjects (usually persons, but also running programs and computers) are able to access objects (usually systems and/or data). Logical access controls work in a number of different ways:

• Subject access A logical access control uses some means to determine the identity of the subject that is requesting access. Once the subject’s identity is known, ...