Access Control Policy

Access control refers to the mechanisms that identify who can and cannot access a network, resource, application, specific action.

type of access control by which the operating system constrains the ability of a subject or initiator to access or generally perform some sort of operation on an object or target. In practice, a subject is usually a process or thread; objects are constructs such as files, directories, TCP/UDP ports, shared memory segments, IO devices etc. Subjects and objects each have a set of security attributes. Whenever a subject attempts to access an object, an authorization rule enforced by the operating system kernel examines these security attributes and decides whether the access can take place. Any operation by any subject on any object will be tested against the set of

This process simplifies access controls by maintaining access control at a single location. One issue with this control method is that the central access control unit is a single point of failure. If the centralized access control unit fails, no access can be granted to objects. Additionally, the central access control can hinder performance if the system is unable to keep up with all access requests.

Information security is the protection of information against accidental or malicious disclosure, modification or destruction. Information is an important, valuable asset of IDI which must be managed with care. All information has a value to IDI. However, not all of this information has an equal value or requires the same level of protection. Access controls are put in place to protect information by controlling who has the rights to use different information resources and by guarding against unauthorised use. Formal procedures must control how access to information is granted and how such access is changed. This policy also mandates a standard for the creation of strong passwords, their protection and frequency of change.

Authority control is a method of controlling and limiting where the object in the catalogue gets shelved under, and what terminology can be used to search for said objects. There are two types of authority control for this database and those are name and subject.

Separation of duties- Which the practice of requiring the process should be divided between two or more individuals. For example, in large organization the Chief Information Security Office (CISO) cannot be the same as security manager.

This research is aimed at conducting a comparative study of the different access control models and report on them. The prescribed text mentions Role Based Access Control in chapter 5 but does not give details on this model and does not provide information on the other access control models. Hence this report seeks to explain the different access control models and compare them based on an analysis of academic literature.

Administrative access controls “define the human factors of security” (Red Hat, n.d.). An example would be having mandatory training before getting access to a certain room. If you do not complete the training, then you will not have access. Other examples of administrative access controls include personnel registration, recovery plans, and disaster preparedness. Physical access controls are “the implementation of security measures in a defined structure used to deter or prevent unauthorized access to sensitive material “and include restricted access rooms that require a badge, password, or some other special permission to enter (Red Hat, n.d.). An example of this would be not related to computers is a barhop standing at the door making sure only 21+ adults enter. In a computer or business example, this could be only letting the IT guy have access to the data center. He would have either a special card to let him in or he would have to make a phone call and use a special passphrase to be granted access into the otherwise locked room. Technical access controls use “technology as a basis for controlling the access and usage of sensitive data throughout a physical structure and over a network “ (Red Hat, n.d.). They include “tools used for identification, authentication, authorization, and accountability. They are software components that enforce access control measures for systems, programs, process, and information” (Harris, 2012). Technical access controls are

The safety and security of the WWTC’s physical space and assets is a shared responsibility of all members of the WWTC community. To meet this obligation, WWTC has established Access Control policy provisions to address the design, administration and management of Access Control systems and measures to ensure their integrity. Access Control privileges are determined and assigned by WWTC administrators based on the specific needs and requirements of WWTC and the key/card holder.

Access controls empower the insurance of security resources by limiting access to frameworks and information by clients, applications and different frameworks. It 's not spectacular, but rather unquestionably, the occupants of sound access control are the foundation of any undertaking data security program. It looks to avert exercises that could prompt a break of security. Access control includes IAAA-Identification, Authentication, Authorization and Accountability. This paper tells about the various access control techniques & technologies, administration, control methods, control types, accountability, control practices, monitoring and threats to access control.

Access control allows specific users either privileges or restriction of access to objects in a database system. A Data Base Administrator (DBA) must take in specific consideration pertaining to which users can see what tables, and perform certain data actions among those specific tables. Access control can be defined in three ways: Mandatory Access Control (MAC), Discretionary

This report will look at various access control methods used by Operating Systems (OS) to control user access to files on a computer and what they can do once they have gained access. In this first section I will look at methods such as Access Control Lists(ACL’s), Capabilities and Encrypting file systems(EFS) and which Operating Systems use these as well as the advantages and disadvantages they have over each other. The second part of my report will focus on one OS and explain in detail the methods it uses to control file access and how it works.

Confidentiality: Access controls help ensure that only authorized subjects can access objects. When unauthorized entities are able to access systems or data, it results in a loss of confidentiality.

Access control: The ability to permit or deny the use of an object (a passive entity such as a system or file) by a subject (an active entity such as a person or process).

Ability to combine access control models. Under our approach, two access control models are combined, namely ABAC and PBAC models. By using the ABAC model, access constraints will be defined for each entity, and by using PBAC, policies enforcing access to a resource will be defined. Under our model, policies will be defined by controlling user, the target user, or the supervisor of the social network.