IDENTITY AND ACCESS MANAGEMENT

CHAPTER 4 - PART 1 - SECTION A

SYSTEM ACCESS PERMISSION AND PHYSICAL
TOPICS COVERED
ACCESS CONTROLS:
● Introduction
● System Access Permission
SYSTEM ACCESS PERMISSION
● Mandatory and Discretionary Access Controls
● Logical Access ● Prerogative to act on a computer resource
○ Usually refers to a technical privilege, such
INTRODUCTION as the ability to read, create, modify or
delete a file or data; execute a program; or
open or use an external connection.
IDENTIFICATION AND AUTHENTICATION (I&A) ● System access at the physical and/or logical
● is a critical building block of computer level
security because: ○ System access to computerized
○ it is needed for most types of access information resources is established,
controls and; managed and controlled at the physical
○ is necessary for establishing user and/or logical level.
accountability.
● I&A is the first line of defense
○ It prevents unauthorized access (or Examples of System Access
unauthorized processes) to a computer Permission/Technical Privilege
system or an information asset. a) the ability to read, create, modify or delete
a file or data
LOGICAL ACCESS b) execute a program
● Can be implemented in various ways c) open or use an external connection
● IS auditor: should be aware of the strengths
and weaknesses of various architectures as Examples of Types of Physical Access Controls
well as risk associated with the different 1) badges (or IDs)
architectures and how they may be addressed. 2) memory cards
● Logical access controls: used to manage and 3) guard keys
protect information assets 4) true floor-to-ceiling wall construction fences
● Logical security: often determined based on 5) locks
the job function of users. 6) biometrics
● Success linked to the strength of the
authentication method
PHYSICAL ACCESS CONTROLS
○ The success of logical access controls is
● Restrict the entry and exit of personnel to an
tied to the strength of the authentication
method. area such as an office building, suite, data
center or room containing information
● Appropriate authorization and access
processing equipment such as a LAN server.
matching to role are necessary
○ All users' access to systems and data
should be appropriately authorized and RECITATION QUESTION #1:
commensurate with the role of the
individual. QUESTION: Give type of physical access controls
● Authorization in the form of signatures Answer:
○ Authorization: generally takes the form of ● badges
signatures (physical or electronic) of ● memory cards
relevant management. ● guard keys
● Strength = Quality ● true floor-to-ceiling wall construction
○ The strength of the authentication is fences
proportional to the quality of the method ● locks
used. ● biometrics

SYSTEM ACCESS PERMISSION LOGICAL SYSTEM ACCESS CONTROLS

● Logical system access controls: restrict the
logical resources of the system (transactions,

1
 Chapter 4: Identity and Access Management Part 1 - Section A

data, programs, applications) and are applied ● Organizations should establish such basic
when the subject resource is needed. criteria for assigning technical access to
● How to determine if access is to be allowed specific data, programs, devices and resources,
(i.e., the information that users can access, the including who will have access and what level
programs or transactions that they can run, of access they will
and the modifications that they can make): ● Example: access to information in the daily
a) Based on the identification and calendar of meetings
authentication of the user that requires a ○ It may be desirable for everyone in the
given resource organization to have access to specific
b) Analyzing the security profile of the user information on the system such as the
and resource data displayed on an organization’s daily
● Such controls may be built into the operating calendar of meetings.
system (OS), invoked through separate ● The program that formats and displays the
access control software and incorporated calendar might be modifiable by only a few
into application programs, database, network system administrators, while the OS
control devices and utilities (e.g., real-time controlling that program might be directly
performance Logical system access controls: accessible by still fewer.
built into the OS, invoked through access
control software, incorporated into programs,
FOUR LAYERS OF IT ASSETS UNDER
databases, network control devices and utilities
LOGICAL SECURITY
(e.g., real-time performance monitors).
1. Networks
2. Platforms
Logical Resources of the System 3. Databases
1) transactions 4. Applications
2) data
3) programs ● Layered security: provides greater scope and
4) applications granularity of control to information
resources.
Examples of Access Requests to System ● Example: Network and platform layers:
a) access on the information that users can Provide pervasive general systems control
access over users authenticating into systems,
b) access on the programs or transactions that system software and application
users can run configurations, data sets, load libraries, and
c) access on the modifications that users can any production data set libraries.
make ● Database and application controls: provide
a greater degree of control over user activity
PHYSICAL AND LOGICAL SYSTEM ACCESS within a particular business process by
● Physical or logical system access (to any controlling access to records, specific data
computerized information): should be on a fields and transactions.
documented need-to-know basis; least
privilege RECITATION QUESTION #2:
○ Need-to-know basis: often referred to as Question: What are the layers of logical security
role-based where there is a legitimate over the IT assets? (provide at least one answer)
business requirement based on least Answer:
privilege. ● Network layer
● Other considerations for granting access: ● Platform layer
accountability (e.g., unique user ID) and ● Database layer
traceability (e.g., logs) ● Application layer
● IS auditor to evaluate appropriateness of
criteria
○ These principles should be used by IS INFORMATION OWNER OR MANAGER
auditors when they evaluate the ● is responsible for the accurate use and
appropriateness of criteria for defining reporting of information
permissions and granting security
privileges.

2
 Chapter 4: Identity and Access Management Part 1 - Section A

● should provide written authorization for ○ Information asset owners: should review
users or defined roles to gain access to access controls periodically with a
information resources under their control. predetermined authorization matrix
● Manager: should handover this that defines the least-privileged access
documentation directly to the security level and authority for an individual/role
administrator to ensure that mishandling or with reference to his/her job roles and
alteration of the authorization does not occur. responsibilities.
● Need to update access, if there is excess
LOGICAL ACCESS CAPABILITIES access
● Logical access capabilities: are implemented ○ Any access exceeding the access
by security administration in a set of access philosophy in authorized matrix or in
rules that stipulate which users (or groups of actual access levels granted on a system
users) are authorized to access a resource at should be updated and changed
a particular level (e.g., read-, update- or accordingly.
execute-only) and under which conditions ● One of the good practices: to integrate the
(e.g., time of the day or a subset of computer review of access rights with human resource
terminals). processes.
● Security administrator: invokes the ● When an employee transfers to a different
appropriate system access control mechanism function (i.e., promotions, lateral transfers or
upon receipt of a proper authorization request demotions), access rights are adjusted at
from the information owner or manager to the same time.
grant a specified user the rights for access to, ● Development of a security-conscious culture
or use of, a protected resource. increases the effectiveness of access controls.
● IS auditor: should be aware that access is
granted to the organization’s information Causes/Reasons for Access Authorization
systems using the principles of need-to-know, Problems (which can impact effectiveness of
least privilege and SoD. access controls)
1) personnel and departmental changes
Relevant Principles on Logical Access to 2) malicious efforts
System 3) plain carelessness
a) need-to-know (role-based)
b) principle of least privilege (POLP) NONEMPLOYEES
c) segregation of duties ● Nonemployees with access to corporate IS
resources should also be held responsible for
Principle of Least Privilege (POLP) security compliance and be accountable for
● Limiting access rights to minimum security breaches.
permissions (needed to do work/task)
● Least amount of privilege necessary
RECITATION QUESTION #3:
Question: When should the security
REVIEW OF ACCESS AUTHORIZATION administrator invoke the appropriate system
● Should be evaluated regularly to ensure that access control mechanism?
they are still valid. Answer: Upon the receipt of a proper
● Personnel and departmental changes, authorization request from the information
malicious efforts, and just plain owner or manager
carelessness: result in authorization creep
and can impact the effectiveness of access
controls. WHO ARE THE NON-EMPLOYEES?
● Increase in risk when access is not removed
● include contract employees, vendor
whenever a personnel leaves the organization
programmers/analysts, maintenance
○ Many times, access is not removed when
personnel, clients, auditors, visitors and
personnel leave an organization, thus
consultants.
increasing the risk of unauthorized access.
● It should be understood that nonemployees
● Need for periodic review of access control
are also accountable to the organization’s
based on authorization matrix
security requirements.

3
 Chapter 4: Identity and Access Management Part 1 - Section A

➢ This distinction must be ensured during

object creation, classification
MANDATORY AND DISCRETIONARY ACCESS
downgrading and labeling.
CONTROLS

Mandatory Access Control (MAC)

MANDATORY ACCESS CONTROLS (MACS)
● access control only managed by the
● are logical access control filters used to administrator;
validate access credentials that cannot be ● cannot be changed/modified by normal
controlled or modified by normal users or users
data owners; they act by default. Discretionary Access Control (DAC)
● good choice to enforce a ground level of ● access control which user has complete
critical security without possible exception, if control over the program he/she owns;
this is required by corporate security policies ● called as a “need-to-know” access model
or other security rules.
● could be carried out by comparing the
sensitivity of the information resources, LOGICAL ACCESS
such as files, data or storage devices, kept on
a user-unmodifiable tag attached to the
INTRODUCTION
security object with the security clearance of
the accessing entity such as a user or an ● Logical access: ability to interact with
application. computer resources granted using
● Only administrators make decisions identification, authentication and
○ Only an administrator may change the authorization.
category of a resource, and no one may ● Logical access controls: primary means used
grant a right of access that is explicitly to manage and protect information assets.
forbidden in the access control policy. ○ Enact and substantiate
● Prohibitive; anything that is not expressly management-designed policies and
permitted is forbidden. procedures intended to protect these
assets and the controls are designed to
DISCRETIONARY ACCESS CONTROLS (DACS) reduce risk to a level acceptable to an
organization.
● controls that may be configured/modified by
● IS auditor: need to understand the
users or data owners
relationship and should be able to analyze
● are a protection that may be activated or
and evaluate the effectiveness of a logical
modified at the discretion of the data owner.
access control in accomplishing information
● data owner-defined sharing of information
security objectives and avoiding losses
resources: where the data owner may select
resulting from exposures.
who will be enabled to access his/her
● Exposures can result in minor inconveniences
resource and the security level of this access.
to a total shutdown of computer functions.
● Cannot override MACs
● act as an additional filter, prohibiting still
more access with the same exclusionary RECITATION QUESTION #5:
principle. Question: Discretionary access controls (DACs)
are a protection that may be activated or
modified at the discretion of the _________.
RECITATION QUESTION #4:
Answer: data owners
Question: What characteristic of MACs states
that anything that is not expressly permitted is
forbidden?
Logical access controls enact and substantiate:
Answer: prohibitive
a) management-designed policies and
procedures intended to protect these assets
❖ When information systems enforce MAC b) the controls that are designed to reduce
policies, the systems must distinguish risk to a level acceptable to an organization
between MAC and the discretionary policies
that offer more flexibility. IS auditors should be able to analyze and
evaluate the effectiveness of a logical access

4
 Chapter 4: Identity and Access Management Part 1 - Section A

● Some systems have proven to be vulnerable

control in:
to shutting themselves down under certain
1) accomplishing information security
conditions of overload.
objectives
2) avoiding losses resulting from exposures
FAMILIARIZATION WITH THE ENTERPRISE’S
IT ENVIRONMENT
LOGICAL ACCESS EXPOSURES
● Technical exposures: are one type of ● IT auditors should gain first understanding of
exposure that exists due to accidental or the IT environment
intentional exploitation of logical access ○ The purpose of this is to determine which
control weaknesses. areas from a risk standpoint warrant IS
● Intentional exploitation of technical auditing attention for planning current and
exposures might lead to computer crime. future work.
● Not all computer crimes exploit technical ● Understanding includes review of the network,
exposures. OS platform, database, and application
● Technical exposures: are the unauthorized security layers associated with the
activities interfering with normal processing, organization’s IT information systems
such as: architecture.
○ implementation or modification of data
and software RECITATION QUESTION #6:
○ locking or misusing user services Question: Who can usually initiate the shutdown
○ destroying data process?
○ compromising system usability Answer: individuals who know a high-level logon
○ distracting processing resources, or ID
○ spying data flow or users’ activities at
either the network, platform (OS),
database or application level. PATHS OF LOGICAL ACCESS - INTRODUCTION
● Access points can be gained through several
avenues.
TECHNICAL EXPOSURES INCLUDE
○ Each avenue is subject to appropriate
levels of access security.
A. DATA LEAKAGE ● Direct path of access (such as a PC terminal
● Siphoning or leaking information out of user tying directly into a mainframe): under
computer; leaves original copy hence may go direct control of main system; users are locally
undetected known, with well-defined access profiles
● This can involve dumping files to paper or can ● Direct access to LAN: more complex; IS
be as simple as stealing computer reports and resources have different access path/levels,
tapes. normally mediated through LAN connectivity,
and the network itself is considered an
important IS resource at a higher access level.
Siphoning - the process of transferring over a
● Most common configuration: combination of
period of time, especially illegally or unfairly
direct, local network and remote access paths
is the most common configuration
B. COMPUTER SHUTDOWN ● Increase in complexity: by several
● Initiated through terminals or personal intermediate devices that act as security
computers connected directly (online) or doors among the various environments
remotely (via the Internet) to the computer. ● Access path through common nodes:
● Only individuals who know a high-level logon back-end or front-end interconnected network
ID usually can initiate the shutdown process, of systems for internally or externally based
but this security measure is effective only if users.
proper security access controls are in place for ● Front-end systems: network-based system
the high-level logon ID and the that connects an organization to outside,
telecommunications connections into the untrusted networks, such as corporate
computer. websites, where a customer can access the
website externally to initiate transactions that
connect to a proxy server application which in

5
 Chapter 4: Identity and Access Management Part 1 - Section A

turn connects to a back-end database system

operations.
to update a customer database.
● To put it in another way, the back-end
○ can also be internally based to automate
system executes actions or responses to
business, paperless processes that tie into
what the front end has started or initiated.
back-end systems in a similar manner

Complexity is increased by several intermediate

devices that act as security doors among the
various environments.

The need of crossing low-security or totally

open IT spaces, such as the Internet, also
necessitates increased complexity.

Front-end systems are network-based systems

connecting an organization to outside, untrusted
networks, such as corporate websites, where a
customer can access the website externally to PATHS OF LOGICAL ACCESS - GENERAL POINTS
initiate transactions that connect to a proxy OF ENTRY
server application which in turn connects to a ● General points of entry control the access
back-end database system to update a customer from an organization’s infrastructure to its
database. information resources
● Based on client-server model
In computer networking, a proxy server is a ● A large organization can have thousands of
system or router that gives a gateway between interconnected network servers.
users and the internet. ● Connectivity should be controlled through a
● Therefore, it assists in preventing cyber smaller set of primary domain controllers
attackers from entering a private network. (servers), which enable a user to obtain access
● It is a server, referred to as an to specific secondary points of entry (e.g.,
“intermediary” (between the the clients or application servers and databases).
requester looking/requesting for resources
and the servers that provide those
resources) because it goes in-between the RECITATION QUESTION #7:
end-users and the web pages they visit Question: What is the most common
online. configurations of paths of logical access?
● A proxy server thus functions on behalf of Answer: A combination of direct access path,
the client when requesting service, local network access path and remote access
potentially hiding the true origin of the path
request to the resource server.
Examples of Information Resources
a) applications
b) databases
c) facilities
d) networks

The client-server model illustrates how a server

gives resources and services to one or more
clients. Examples of servers consist of mail
servers, web servers, and file servers.
Back-end systems are related with databases
and data processing elements. Each of the servers provides resources to client
devices, such as laptops, desktop computers,
Hence, the purpose of a back-end system is to smartphones and tablets. Most of the servers
start the operating system's programs to have a one-to-many relationship with clients,
respond to front-end system requests and which means a single server can provide

6
 Chapter 4: Identity and Access Management Part 1 - Section A

resources to many clients at one time.

Connectivity in this client-server environment

needs to be controlled through a smaller set of
primary domain controllers (servers), which
2) REMOTE ACCESS
enable a user to obtain access to specific
● Requires authentication to the server to
secondary points of entry (e.g., application
perform functions remotely
servers and databases).
○ A user connects remotely to an
organization’s server, which generally
GENERAL MODES OF ACCESS OCCUR THROUGH: requires the user to identify and
authenticate him/herself to the server
1) NETWORK CONNECTIVITY for access to specific functions that can
● Linking PC to an organization’s network be performed remotely (e.g., email, File
infrastructure, either through a physical or a Transfer Protocol [FTP] or some
wireless connection. application-specific function).
● Access requires user identification and ● Complete access requires virtual private
authentication to a domain-controlling server. network (VPN), which allows a secure
● More specific access requires more particular authentication and connection into those
authentication resources where privileges have been granted.
● Other modes of access through network ● Can be extensive and should be centrally
management devices, such as routers and controlled
firewalls, which should be strictly controlled.
Examples of Specific Functions that Can be
Done Remotely
At a minimum, access requires user identification 1) email function
and authentication to a domain-controlling 2) file transfer protocol (FTP) function
server. More specific access to a particular 3) application-specific function
application or database may also require the
users to identify and authenticate themselves to File Transfer Protocol (FTP) is a client/server
that particular server (secondary point of entry). protocol or rule used for transferring files to or
Domain-controlling server or domain from a host computer. FTP can be authenticated
controller: with usernames and passwords.

Complete access to view all network resources

usually requires a virtual private network (VPN),
which allows a secure authentication and
connection into those resources where privileges
have been granted.

Virtual private network (VPN) is an encrypted

connection over a public infrastructure, like the
Internet, from a device to a network. The
encrypted connection helps in ensuring that
Application and database servers: sensitive or confidential data is transmitted safely.
It stops unauthorized people from eavesdropping
or spying on the traffic and permits the user to

7
 Chapter 4: Identity and Access Management Part 1 - Section A

perform work remotely. VPN technology is

commonly used in corporate environments.

● Organization should know all the points of

entry into the information resource
infrastructure which, in many organizations,
will not be a trivial task (e.g., thousands of
remote access users).
● Not controlled point of entry can compromise
security of an organization’s sensitive and
critical information resources.
● IS auditors should determine if all points of
entry are known and should support
management’s effort to identify all access
paths

RECITATION QUESTION #8:

Question: What is an example of network
management devices?
Answer:
1) Routers
2) Firewalls

When performing detailed network

assessments and access control reviews, IS
auditors:
1) should determine whether all points of entry
are known;
2) should support management’s effort in
obtaining the resources to identify and
manage all access paths