Access Control Scenario

Your company has recently upgraded its accounting software. The consultant who installed the software has explained that a new option makes the system available through the Internet for staff remote access capability. Previously, staff only had access to the system when they were physically in the headquarters building. With remote access to the system, they would be able to access the system from anywhere by entering their user name and password. Currently, user name and password specifications are not regulated. For example, passwords are allowed to be as short as three characters and may remain unchanged for up to six months.

Some of the staff expressed interest in being able to access the system from home, especially on weekends, instead of making the drive into town. Additionally, some managers have expressed a desire to be able to access some of the reports when they are away at business meetings. As the IT Audit Director, the decision as to whether to implement remote access is in your hands.

Questions

Answer the questions below with reference to the most relevant COSO's Risk Assessment, Control Activity, Information and Communication and Monitoring Principles and corresponding Focus Points.

1. What risk assessment principles should you consider before deciding whether to allow remote access?

2. If remote access is allowed, what do you recommend as a password policy to minimize the opportunity for mishandling of remote access?

3. How should the password policy be communicated to employees?

4. What monitoring controls should be put in place to detect if the password policy is working?