5.3 : Logical Access (Doshi)

Question 1

Logical access controls in information technology is used for the following (4):

Answer 1

(1) identification
(2) authentication
(3) authorization, and
(4) accountability in computer information systems

Question 2

The two main types of access controls:

Answer 2

(1) physical and

(2) logical

Question 3

Physical access control

Answer 3

Limits access to campuses, buildings, facilities, and physical IT assets

Question 4

Logical access control

Answer 4

Limits connections to computer networks, system files and data.

Question 5

Four main categories of access controls are:

Answer 5

(1) Mandatory Access Control (MAC)
(2) Discretionary access control (DAC)
(3) Role-based access control
(4) Rule-based access control

Question 6

Mandatory Access Control (MAC)

Answer 6

is logical access control that cannot be controlled or modified by normal users or data owners.

Question 7

Discretionary Access Control (DAC)

Answer 7

(DACs) are logical access control that may be activated or modified by the data owners at their discretion.

Question 8

MAC compared to DAC ; in terms of data security, which is the best choice

Answer 8

MACs are better choice

Question 9

Steps to follow when implementing logical access control:

Answer 9

(1) Inventory of IS resources
(2) Classification of IS resources
(3) Grouping/labeling of IS resources
(4) Creation of an access control list

Question 10

What is the first step on data classification?

Answer 10

Identify the owner of the data/application

Question 11

Automated password management tool vs Manual password management tool

Answer 11

In any given scenario, an automated password management tool works as best preventive control and ensures compliance with password management policy

Question 12

Preventive controls as compared to detective and deterrent controls

Answer 12

In any given scenario, PREFERENCE to be given to PREVENTATIVE controls as compared to detective or deterrent controls.

Question 13

Automated controls as compared to manual controls

Answer 13

In any given scenario, preference to be given to automated controls as compared to manual controls

Question 14

What is the prime objective of review of logical access control?

Answer 14

to ensure access have been assigned as per organization’s authorization

Question 15

In any given scenario, data owner/system owner is ultimately responsible

Answer 15

for defining the access rules.

Question 16

In any given scenario, following are the logical steps for data classification:

Answer 16

• First step is to have inventory of Information Assets.
• Second step is to establish ownership.
• Third step is classification of IS resources.
• Fourth step is labelling of IS resources.
• Fifth step is creation of access control list.

Question 17

In any given scenario, accountability for the maintenance of proper security controls over information assets resides with

Answer 17

the data owner/system owner.

Question 18

In any given scenario, greatest benefit of well defined data classification policy is

Answer 18

decreased cost of control.

Question 19

In any given scenario, most important objective of data protection is to

Answer 19

(i) ensure integrity/confidentiality of data and (ii) establish appropriate access control guidelines.

Question 20

Data classification must take into account following requirements:

Answer 20

• Legal/Regulatory/Contractual
• Confidentiality
• Integrity
• Availability

Question 21

In information technology, logical access controls are tools and protocols used for

Answer 21

identification, authentication, authorization, and accountability in computer information systems.

Question 22

The four main categories of access control are:

Answer 22

Mandatory access control

Discretionary access control

Role-based access control

Rule-based access control

Question 23

Mandatory Access Control: Mandatory Access Controls (MACs) are logical access control that cannot be

Answer 23

controlled or modified by normal users or data owners.

Question 24

Discretionary Access Control: Discretionary Access Controls (DACs) are logical access control that may be

Answer 24

activated or modified by the data owners at their discretion.

Question 25

)In any given scenario, MACs are BEST choice in terms of data security

Answer 25

as compared to DACs.

Question 26

In any given scenario, following are the steps for implementing logical access controls:

Answer 26

(a) Inventory of IS resources.
(b) Classification of IS resources.
(c) Grouping/labelling of IS resources.
(d) Creation of an access control list.

Question 27

In any given scenario, first step in data classification is

Answer 27

to identify the owner of the data/application.

Question 28

In any given scenario, an automated password management tool works as

Answer 28

BEST preventive control and ensures compliance with password management policy.

Question 29

Please note below access control best practices for wireless security. Invariably 2-3 questions will be there on this concept:

Answer 29

(a)Enable MAC address filtering:

Every Machine (PC/Laptop/Mobiles) has a unique identification number. That is known as Media Access Control (MAC) address. So through this control, you allow access to only selected devices. Any other device trying to access you network will be rejected by your router.

(b)Disable SSID (Service set identifier) broadcasting

A Service Set Identifier (SSID) is the wireless network name broadcast by a router and it is visible for all wireless devices. When a wireless device searches the area for wireless networks it will detect the SSID.

(c)Enable WPA-2 (Wi-Fi protected access) protection:

Encryption helps to scrambles the information we send through wireless network into a code so that it’s difficult for other to access. Using encryption is the effective way to secure your network from intruders.

Question 30

Two main types of encryption are available for this purpose:

Answer 30

Wi-Fi Protected Access (WPA) and Wired Equivalent Privacy (WEP).

Question 31

WPA 2 is the strongest

Answer 31

encryption standard for wireless connection as on today.

Question 32

In any given scenario, preference to be given to preventive controls

Answer 32

as compared to detective or deterrent controls.

Question 33

)In any given scenario, preference to be given to automated controls

Answer 33

as compared to manual controls.

Question 34

In any given scenario, default deny access control policy (i.e. deny all traffic except selected ones) is more robust and stringent access control policy

Answer 34

as compared to default allow access control policy (i.e. allow all traffic except selected ones)

Question 35

Prime objective of review of logical access control is

Answer 35

to ensure access have been assigned as per organisation’s authorization.