An IS auditor should review the logical access control of the organization with the prime objective of determining whether access is granted and controlled as per approved authorizations. As a CISA aspirant, you are expected to understand the concepts of identity and access management. Let's have a look at these concepts.
Logical access controls are a set of tools and protocols with the objective and purpose of the following:
- Identification
- Authentication
- Authorization
- Accountability
Access control categories
The following are the major categories of access control:
|
Type
|
Description
|
| Mandatory access control (MAC) | Control rules are governed by an approved policy. Users or data owners cannot modify the access role. |
| Discretionary access control (DAC) | Control access can be activated or modified by the data owner as per their discretion. |
MAC is considered more robust and stringent in terms of information security compared to DAC. To increase...
