O'Reilly logo

The CISA® Prep Guide: Mastering the Certified Information Systems Auditor Exam by John Kramer

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

4.4. Evaluating Logical Access Controls

Control of the access to data and systems is a major part of information security and the primary objective of any audit reviewing data for integrity and confidentiality. There are many ways to control access and many devices and programs on which to control it. Different configurations lend themselves to different solutions that will work best or be sufficient to mitigate the risk to an acceptable level. Let's begin by reviewing several techniques used to control access logically.

4.4.1. Good Passwords

Passwords are the most common and widely used means of controlling logical access and are used as a control mechanism for physical access as well. A combination lock is really a password-controlled access device, if you think about it. Anyone knowing the password gets in. The assumption must be made that knowing the password is equivalent to the identity validation originally performed when the user enrolled and was given the account. Of course, this is a flawed argument, because many things can happen to a password to expose it as the secret managed by the actual holder of the identity. The following discussion assumes that for access control use, the first thing you will check is to ensure that passwords are required when a password control scheme is used. Blank spaces, or hitting enter, should not be considered a valid password. Policies should require the usage of passwords as a minimum access control requirement and may spell out some ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required