Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Dunmore Health stores patient records that clinicians access from tablets on hospital wards. The board wants a control so that a stolen tablet cannot reveal records even if its password is bypassed. Which control best meets this requirement?

Full-disk encryption with separately held keys is best. It keeps stored records unreadable even if the tablet is stolen and the password is bypassed. Password changes, perimeter firewalls and access logs do not protect data on a lost device.

  1. AFull-disk encryption of data stored on the device, with keys held separately from the deviceCorrect
  2. BRequiring passwords to be changed every 30 days
  3. CInstalling a firewall at the hospital network perimeter
  4. DLogging all clinician access to records for later review

Explanation

Encryption at rest makes data unreadable without the key, so bypassing the login does not expose records. Password rotation is preventive only at login, a perimeter firewall does not protect a device off-site, and logs are detective and do not stop disclosure.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions