Understanding IT Infrastructure Risks and Workstation Security:
Reviewing an organization’s IT infrastructure risks includes assessing the security of workstations (desktops, laptops, and terminals) that connect to the organization's network.
Workstations are vulnerable to physical theft, unauthorized access, and malware attacks, making physical controls a critical security measure.
Why Physical Controls Are the Most Relevant for Workstations:
Physical controls prevent unauthorized physical access, theft, tampering, and damage to workstations.
Examples include:
Locked office spaces or workstation enclosures to restrict access.
Security badges or biometric authentication to prevent unauthorized use.
Cable locks for laptops and desktop computers to deter theft.
Surveillance cameras and security guards to monitor access.
Why Other Options Are Incorrect:
A. Input controls – Incorrect.
Input controls ensure accuracy and completeness of data entry, which applies more to application security, not workstation security.
B. Segregation of duties – Incorrect.
Segregation of duties prevents fraud and conflicts of interest, but it does not directly address workstation security risks.
D. Integrity controls – Incorrect.
Integrity controls ensure data consistency and accuracy in databases and transactions, not workstation security.
IIA’s Perspective on IT Risk and Physical Security Controls:
IIA Standard 2110 – Governance requires organizations to implement physical security measures for IT assets, including workstations.
IIA GTAG (Global Technology Audit Guide) on IT Risks highlights the importance of restricting physical access to IT devices to prevent unauthorized use or data breaches.
ISO 27001 Information Security Standard recommends physical controls to secure IT infrastructure and prevent workstation-related risks.
IIA References:
IIA Standard 2110 – IT Security & Physical Access Control
IIA GTAG – Physical Security of IT Assets
ISO 27001 – Physical Security and IT Risk Management
Thus, the correct and verified answer is C. Physical controls.
