Proposal For The Windows Security Management

Formal user access control procedures must be documented, implemented and kept up to date for each application and information system to ensure authorised user access and to prevent unauthorised access. They must cover all stages of the lifecycle of user access, from the initial registration of new users to the final de-registration of users who no longer require access. These must be agreed by IDI. User access rights must be reviewed at regular intervals to ensure that the appropriate rights are still allocated. System administration accounts must only be provided to users that are required to perform system administration tasks.

• Prepare a 5 to 10 minute PowerPoint assisted presentation on important access control infrastructure, and

Individual users play an important role in any form of institution or organization but concerns are raised about the security. The network administrators clearly lay down a set of rules, regulations and protocols that an individual user has to agree accordingly upon which part of the resources and what class of service that the user can obtain.

internal and external users to whom access to the organization’s network, data or other sensitive

Access control refers to the mechanisms that identify who can and cannot access a network, resource, application, specific action.

C1 - Discretionary Security Protection: In this sub division Access Control Lists (ACLs) security which protect User/Group/World. Security will protect following Users who are all on the same security level, Username and Password protection and secure authorisations database (ADB), Protected operating system and system operations mode, Periodic integrity checking of TCB, Tested security mechanisms with no obvious bypasses, Documentation for User Security, Documentation for Systems Administration Security, Documentation for Security Testing, TCB design documentation and Typically for users on the same security level.

This is an open exposure due to the uncertainties of the internet. Controlling access to information systems and associated networks is necessary for the preservation of their confidentiality, integrity, and availability. Confidentiality assures that the information is not disclosed to unauthorized persons or processes. Any automated attacks or personal attack or attack to exploit the company secrets/statistics/data is the biggest threat to that may occur without the firewall.

The Access Control prevention can be built from a standards standpoint that can enable a great number of protective methods in its existence .As www.nyu.edu reminds us “Software Updates: System must be configures to automatically update operating system software, server application (webserver, mail server, database, server, etc),client software(web-browsers, mail-client, offices suites, etc),and malware protection software(anti-virus, anti-spyware, etc).For Medium or High Availability System, a plan to manually apply new updates within a documented time period is an acceptable

mandatory and discretionary access control policies. ACM Transactions on Information and System Security, Vol. 3, No. 2.

While this is a daunting task, by breaking these controls down into larger groups the basis for policies and procedures are outlined and framed. The key areas that must be met initially are the establishment of a system security plan that describes we are implementing as well as the security control requirements for the

Information security is the protection of information against accidental or malicious disclosure, modification or destruction. Information is an important, valuable asset of IDI which must be managed with care. All information has a value to IDI. However, not all of this information has an equal value or requires the same level of protection. Access controls are put in place to protect information by controlling who has the rights to use different information resources and by guarding against unauthorised use. Formal procedures must control how access to information is granted and how such access is changed. This policy also mandates a standard for the creation of strong passwords, their protection and frequency of change.

Role based access control is an ideology through which access to systems is restricted based on authority given. It is used by organizations with a relatively large number of employees ranging from five hundred to one thousand and above (Sieunarine & University of Oxford, 2011). This is implemented through the mandatory access control or through the discretionary access control. These are the only two ways through which role based access control can be implemented.

As the use of computers, databases, and technology in general, security has grown to be a powerful tool that has to be used. The threat of outside sources intruding and exploiting crucial information is a threat that is present on a daily basis. As a part of creating and implementing a security policy, a user must consider access control. Access Control is a security tool that is used to control who can use or gain access to the protected technology. Access control security includes two levels; logical and physical. Though database intrusions can happen at any moment, access control provides another security barrier that is needed.

Confidentiality: Access controls help ensure that only authorized subjects can access objects. When unauthorized entities are able to access systems or data, it results in a loss of confidentiality.

Access control: The ability to permit or deny the use of an object (a passive entity such as a system or file) by a subject (an active entity such as a person or process).