It 244 Appendix F Essay

Formal user access control procedures must be documented, implemented and kept up to date for each application and information system to ensure authorised user access and to prevent unauthorised access. They must cover all stages of the lifecycle of user access, from the initial registration of new users to the final de-registration of users who no longer require access. These must be agreed by IDI. User access rights must be reviewed at regular intervals to ensure that the appropriate rights are still allocated. System administration accounts must only be provided to users that are required to perform system administration tasks.

Access control is a significant area to be covered. Access Control Mechanisms are comprised of Access Control Lists

In computer security, Discretionary Access Control (DAC) is a type of access control in which a user has complete control over all the programs it owns and executes, and also determines the permissions other users have those those files and programs. Because DAC requires permissions to be assigned to those who need access, DAC is commonly called described as a "need-to-know" access model.

RBAC is a very efficient way to control access to resources. This is because access is granted to select roles based on what the needs each role has to complete its job. Then, the person or program is assigned to the role and thus will only be granted the access granted to the role they are assigned.

Access Controls provide a mechanism, which allows an administrator to ensure that appropriate techniques are in place to control how users interact with an IT system. It provides an avenue where restrictions can be developed, specifying what a user can do, the resources they can access, and the functions they can execute on a system. It is aligned with the three main security principles; confidentiality, integrity and availability. This alignment ensures that data and resources within an IT system will remain confidential as required, the structure will remain intact and these objects will remain available, so as not to diminish the functionality of the system. Access controls that are incorporated into a security plan are

Computer security is important in every organization. It covers several areas such as locking the computer room and the computer itself, protecting login accounts with passwords, encrypting network communication lines and use of file protection among others. Whitman (2011) points out that computer system security ensures that your computer does what it is supposed to, even if the users do what they should not do. Discretionary Access Control (DAC) is a type of access controls that provides protection to the files in a computer system. This type of control restricts access to files based on the identity of users or groups which they belong. It is discretionary and lets you tell the computer system who can have access to your files and therefore you can specify the type of access allowed. For example, you can allow anyone to read a particular file in the system, but allow only you to be able to change it.

Steady measures for arrange access and verification are basic to the organization's data security and are frequently required by directions or outsider assertions. Any client getting to the organization's PC frameworks can influence the security of all clients of the system. A fitting Network Access and Authentication Policy diminishes danger of a security episode by requiring reliable utilization of verification and access benchmarks over the system.

This chapter is basically based on access control in regards to computer information security. Access control is seen as the fundamental mechanism put in place to help make information security successful. Access control feature, in a particular system, will control how users can communicate, access and modify system resources and programs. Access control was described in this chapter as a very useful tool for the computer information security because it helps with ensuring that unauthorized person or program have no access to what they are not supposed to. Access control is regarded as the first line of defense to control, protect and monitor organization’s resource’s availability, confidentiality and integrity.

Finally, auditors must be informed on the measures and controls taken at the entry point of the information system. It is essential that only the right people have access to the right data and programs, to prevent security breaches that may compromise the integrity of the entire information system. In essence, auditors must understand the “nature and characteristics of an entity’s use of IT in its information system” to address the risks posed by IT and its users (page 126). Aiding this process may also include interviews with users with access privileges, and an understanding of segregation of

The User does not have any privilege to change or modify his setting or access level to any party. On the other end, Discretionary Access Control Model gives the User all the rights and privileges over any object on his profile including all the programs associated with it. This means that the User can be able to modify security settings and privileges for others. This of course is very flexible at the expense of security rigidity. Which in turn may lead to misuse or abuse of privilege which is a major setback for this model. Rule Based Access Control is administered based on some predefined rules set by the Systems Administrator for each User. This means that there are as equal the rules set as the number of Users in the Organisation. This eventually becomes cumbersome as the number of Users gets larger.(Anon n.d.). The Role Based Access Control is based on the user’s role or job functions. Permissions are granted to the role and not the individual. For example if the user performs role of a Deputy Manager, he is mapped to the role of a Deputy Manager. And thus He shares a common role with any other User of the same position in the same Organisation. This access control model offers more flexibility and ease of Management to the Administrator from a central location; as there are fewer roles to manage as compared to the number of Users. Context Aware Access Control takes into consideration the context information of

Access control is the next component in hardening the security for this facility. Access control defines who has access to systems, data and dialogue using cryptographic protections (Boyle & Panko, 2013). An Access control system provides three main functions, authorization, authentication and auditing (Boyle & Panko, 2013). It is recommended that a directory server be installed to provide centralized authentication, authorization and auditing services for this facility.

Access control limit access to sensitive data based on organisation policies by determining who and how data can be accessed based on a “need to know” of an entity like an employee’s name, position or something you are like fingerprints (Goodrich and Tamassia 2011, Kizza 2010). Additionally identity depends on other characteristics such as something you are acquainted with like password and something you have like secret encryption key. Access control is based on the assumption that only the authorized entity has possession of what they are, know or have (Shabtai, Yuval and Rokach 2012).

So, how these rights of system accessibility are given to the individual as per their job duties and designation? This is where we used an access control model.

In Discretionary Access Control any user can set an entrance control instrument to permit or deny access to an object. DAC relies on the object proprietor to control access. It is generally executed in most working frameworks, and is very familiar access control method. Flexibility is a strength of DAC and a key motivation behind why it is broadly known and actualized in standard working frame.

The hardware and software components of an information system is very important to the overall functionality of the business organization. To ensure that only the right persons are accessing sensitive information technical safeguards provide a sense of safety. Identification and authentication is very critical for any information system. Identification is the unique username that employees are usually given or is made by themselves. This