2.  Controls that provide security against internal and external threats  2 Types of access controls: › Physical controls › Logical controls

3.  Buildings including their power and security  Technology centers  Telecommunication rooms (switches, hubs, routers)  Customer documentation  Audit files  Inventory

4.  Biometric devices  Security guards  Locks and keys  Surveillance  Alarm system

5.  Servers and their operating systems  Network systems  Database systems or file systems  Users Applications  Communication systems  Online Reports  Audit logs

6.  Firewalls  Encryption  Passwords  Authentication system

7. Level of protection Level of Risk

9.  Risk assessment  Test of controls  Analysis  Feedback

10.  Size of the system  Complexity  Local vs. Remote  Wireless Technologies  Shared files and databases  Changes to infrastructure

11.  Penetration tests  Monitor controls  Review controls

13.  Number of external intrusion attempts  Number of internal unauthorized attempts  Number of security incidents caused by unauthorized access  Number of entitlement reviews not in compliance

14.  www.questbiometrics.com, 2005. “Biometrics solutions; Classification of Biometric Technologies based on physical traits.” www.questbiometrics.com  Participating with Safety Briefing no. 3 “Passwords & Access Controls”, March 2002. Paul Mobbs, Association for Progressive Communications.  Access Controls, www.wikipedia.orgwww.wikipedia.org  Singleton, Tommie W. “What every IT Auditor should know about Access Controls. Information systems Control Journal. Volume 4. 2008  Muthukrishan Ravi. G38 Access Controls ISACA. www.isaca.org. February 1, 2008.www.isaca.org