Chapter 4: Identity and Access Management - Section A Flashcards
Introduction: Identification and authentication is important because it establishes what?
User Accountability
Introduction: What is the first line of defense for most systems
Identification and authentication
Introduction: Logical access can be implemented in a few ways (T or F)
False. It can be implemented in various ways
Introduction: Logical security is often determined based on?
The job function of the users
Introduction: The success of logical access controls is tied to the what?
Strength of the authentication method
Introduction: What is usually the form of authorization?
Signatures either physical or electronic
Introduction: The strength of the ________ is proportional to the quality of method used
Authentication
System Access Permission: System access permission is the prerogative to act on a computer resources (T or F)
True
System Access Permission: Usually refers to an administrative privilege (T or F)
False. Technical
System Access Permission: It is established, managed, and controlled at the physical and not logical level (T or F)
False. Both levels
System Access Permission: Logical system access controls built into what? Invoked by what? And Incorporated into what?
Operating system; Access control software, application programs
System Access Permission: Physical or logical system access to any computerized information should be on what basis?
Need to know/ least privilege
System Access Permission: What are the other considerations for granting access and must be used by IS auditors when determining the criteria for defining permissions.
Accountability and traceability
System Access Permission: What are the four layers of logical security?
- Networks
- Platforms
- Databases
- Applications
System Access Permission: The four layers of security for system access provides what to information resources?
Greater scope and granularity of control
System Access Permission: Determine what layer of security is being described here
pervasive general
systems control over users authenticating into systems, system software
Network and platform layers
System Access Permission: Determine what layer of security is being described here
generally provide a greater degree of
control over user activity within a particular business process by controlling
access to records, specific data fields and transactions
Database and application controls
System Access Permission: The information owner who’s responsible for the information should provide what? And handed over to who?
Written authorization for users; security administrators
System Access Permission: Which principles should the IS auditor take into account when determining access to systems
Need to know, least privilege, SoD
System Access Permission: Who implements logical access capabilities
Security Administrator
System Access Permission: Reviews of access authorization must be what? To ensure the validity
Evaluated regularly
System Access Permission: Personnel and departmental changes, malicious efforts, and
just plain carelessness result in authentication creep (T or F)
False. Authorization
System Access Permission: What is a good practice when it comes to avoiding authorization creep
Integrating review of access rights with human resource processes.
System Access Permission: Non Employees with access to corporate IS resources should also be held responsible for security compliance and be accountable for security breaches despite not being part of the organization (T or F)
True
Mandatory and Discretionary Access Controls: are logical access control filters used to validate access credentials that cannot be controlled or modified by normal users or data owners;
Mandatory Access Controls
