Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Kestrel Logistics lets warehouse supervisors log in to its inventory system with a password only. After a phishing incident, the board wants a control that remains effective even if a password is stolen, without redesigning the system. Which control best meets this need?

Multi-factor authentication is best because it requires a second independent factor, such as a one-time code from a registered device. A phished password alone then cannot grant access, whereas password rotation, longer passwords or banners still depend on one factor or only deter.

  1. ARequiring passwords to be changed every 30 days
  2. BIntroducing multi-factor authentication combining a password with a one-time code from a registered deviceCorrect
  3. CIncreasing the minimum password length to 12 characters
  4. DDisplaying a warning banner at each login about unauthorised access

Explanation

Multi-factor authentication requires a second, independent factor (something the user has), so a stolen password alone is insufficient. Frequent changes and longer passwords still rely on a single factor that phishing can capture. A warning banner is a deterrent only and does not stop access.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions