2: Auditing Logical access controls

Question 1

auditing net access

Answer 1

The IS auditor should conduct an independent review of the IT infrastructure to map out the organization’s logical access paths.

The IS auditor should request network architecture and access documentation to compare what was discovered independently against existing documentation. The auditor will need to determine why any discrepancies exist.

Question 2

auditing users access control

Answer 2

• Authentication
• Authentication bypass - to see if it possible for users to bypass authentication
• Access violations - See if systems, networks have the ability to log access violations.
• User account lockout - see if systems can lockout after several attempts.
• IDS & IPS - See if any IPS is installed that would detect authentication-bypass. See if the IPD/IPS are well configured and up to date.
• Dormant accounts- if they are an automated or manual process to identify dormant accounts.
• Shared accounts -
• Systems accounts - The IS auditor should identify all system-level accounts on networks, systems, and applications.
• Jump servers - The IS auditor should determine who has access to jump servers, whether they can be bypassed, and whether they can be used to exfiltrate data.

Question 3

Auditing users access provisioning

Answer 3

The IS auditor should identify all user access request processes and determine if these processes are used consistently throughout the organization.

Question 4

Access approvals

Answer 4

Access approvals When studying the user access process, the IS auditor needs to determine how requests are approved and by what authority they are approved.

Question 5

New employee provisioning

Answer 5

The IS auditor should examine the new employee provisioning process to see how a new employee’s user accounts are initially set up.

The IS auditor also needs to determine how initial user credentials are communicated to the new employee and if the method is secure and reasonable.

Question 6

Segregation of duties (SOD)

Answer 6

The IS auditor should determine if privileges within or among applications that would constitute SOD violations. The auditor should determine how violations are managed when they are found.

Question 7

Access reviews

Answer 7

The IS auditor should determine if there are any periodic access reviews and what aspects of user accounts are reviewed; this may include termination reviews, internal transfer reviews, SOD reviews, and dormant account reviews.