Physical vs Logical - Location/Address

Question

According to the CJIS Security Policy -

Access Enforcement

The information system shall enforce assigned authorizations for controlling access to the system and contained information. The information system controls shall restrict access to privileged functions (deployed in hardware, software, and firmware) and security-relevant information to explicitly authorized personnel.

Access control policies (e.g., identity-based policies, role-based policies, rule- based policies) and associated access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) shall be employed by agencies to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains) in the information system.

Agencies shall control access to CJI based on one or more of the following:

1. Job assignment or function (i.e., the role) of the user seeking access
2. Physical location
3. Logical location
4. Network addresses (e.g., users from sites within a given agency may be permitted greater access than those from outside)
5. Time-of-day and day-of-week/month restrictions

Are physical location and logical location are being referred as Physical address and Logical Address here? How these are different from Network Addresses.

Can someone please give the scenarios to make website compliant with CJIS Security Policy?

Answer 1

I cant give a scenario but I can tell you the difference in location. Physical Location in your terms refer to where your access the site from, as in a physical address. The logical address is what device you are using. Because Full blown computers are now the size of cell phones, the definitions have to change to better suit the understanding. Also you can go anywhere off the map and still access data, for this Physical Location is now deemed as a GPS Location Address. A network address refers to your IP Address.