Access Control And Computer Based Information Systems

Authorization is the act of checking to determine if a user has the proper permission to access a file or perform an action, after the user has properly identified themselves through authentication (Username/Password). Authorization is provided to users based on a job requirement or a need to know that allows them to access the required material. Authorization is usually determined when a user first gains access to a system but may change over time. If a change occurs that requires more or less authorization for a particular employee, the concerned supervisor should contact the appropriate authority to make the change.

Formal user access control procedures must be documented, implemented and kept up to date for each application and information system to ensure authorised user access and to prevent unauthorised access. They must cover all stages of the lifecycle of user access, from the initial registration of new users to the final de-registration of users who no longer require access. These must be agreed by IDI. User access rights must be reviewed at regular intervals to ensure that the appropriate rights are still allocated. System administration accounts must only be provided to users that are required to perform system administration tasks.

Individual users play an important role in any form of institution or organization but concerns are raised about the security. The network administrators clearly lay down a set of rules, regulations and protocols that an individual user has to agree accordingly upon which part of the resources and what class of service that the user can obtain.

Access refers to the inflow or exchange of information between a subject(person) and a resource which could be a system, it could also be seen as the unrestricted activity an individual is allowed to perform within any given scenario or environment.

Access control refers to the mechanisms that identify who can and cannot access a network, resource, application, specific action.

VNC is stands for a Virtual Network Computing which is an open source platform for accessing desktop on remote machines with the help of LAN over a WAN or Internet connection. In this project discuss various methods of developing or building a virtual network with provides a good security to each one of them. VNC is platform independent so we can use any operating system such as UNIX, Windows, MAC OS x etc. It will also cover the open connection and tunneled connection of SSH (Secure Shell). In my project, I will apply technique to build a secure virtual network. In this present era there are many multinational company in the market company users are able to share their resources and applications without any kind of high level on software and hardware resources. Mobility is important in this fast peace world therefore the

Authentication factors could be classified into four factors which are, factors that users never forget, factors that people use to get access, factors that people have on their body, and the location. To explain more, multifactor authentication is recommended because of the security incidents these days. The worst factor that I used in my life is password because it does provide less security and anyone could guess passwords. Right now, I am using passphrases even in my social media accounts. Another example is the PIN number at the ATM machine, it provides security but sometimes not active because of the scammers. Mobile applications help a lot in our life and some application have security roles that ensures the security and privacy. Biometric is another important method in protection using fingerprint is the most common way. Finally, getting the location of the user is an important method for security, a good example is location services in the phone or

Mandatory access control is a single user, normally the network admin, who is given access to the users’ rights and privileges. They control access policies and are also in control of choosing which objects and what systems each individual user has access to and what they do not have access to. The access is made in the form of different levels. Each system and all folders containing information are put into a specific classification. The user will be in a certain classification that will only allow them to access data

Due in Week Seven: Outline the Access Control Policy. Describe how access control methodologies work to secure information systems

3.p16 The purpose of access control is to regulate interactions between a subject and an object, such as data, a network or device

mandatory and discretionary access control policies. ACM Transactions on Information and System Security, Vol. 3, No. 2.

Role based access control is an ideology through which access to systems is restricted based on authority given. It is used by organizations with a relatively large number of employees ranging from five hundred to one thousand and above (Sieunarine & University of Oxford, 2011). This is implemented through the mandatory access control or through the discretionary access control. These are the only two ways through which role based access control can be implemented.

As the use of computers, databases, and technology in general, security has grown to be a powerful tool that has to be used. The threat of outside sources intruding and exploiting crucial information is a threat that is present on a daily basis. As a part of creating and implementing a security policy, a user must consider access control. Access Control is a security tool that is used to control who can use or gain access to the protected technology. Access control security includes two levels; logical and physical. Though database intrusions can happen at any moment, access control provides another security barrier that is needed.

Confidentiality: Access controls help ensure that only authorized subjects can access objects. When unauthorized entities are able to access systems or data, it results in a loss of confidentiality.

Access control: The ability to permit or deny the use of an object (a passive entity such as a system or file) by a subject (an active entity such as a person or process).