Describe a secure login procedure typical for BCC workstations.

• A. Single-factor password only with no audit logging.
• B. Multi-factor authentication, role-based access, session timeouts, and audit logging.
• C. Public guest access with no authentication.
• D. External USB tokens required for every login, with no restrictions.

Answer: (B)

Defense-in-depth for workstation access emphasizes strong verification, controlled privileges, time-bound access, and traceability. Multi-factor authentication adds at least two forms of verification, so even if a password is compromised, an attacker still needs a second factor to gain access. Role-based access enforces least privilege, ensuring users can only reach the systems and data necessary for their role. Session timeouts help prevent unauthorized use after a user leaves a workstation, and audit logging records who signs in, when, from where, and what actions are taken, providing visibility for monitoring and investigations.

The other options miss essential controls. A single-factor password with no audit logging leaves credentials vulnerable and provides no record of who did what. Public guest access with no authentication is inherently insecure and unsuitable for a controlled environment. Requiring external USB tokens for every login, with no restrictions, would still raise concerns about token management, loss, and lack of integrated access control and auditing.