Discuss the three components of Access Control and their importance to business. Your initial response is due by Thursday 11:59PM. It must be at least 250 words and have references. Your grade will re
Three components of Access Control and their importance to business
Top of Form
In the fields of physical security and information security, access control is the selective restriction of access to a place or other resource while access management describes the process. The act of accessing may mean consuming, entering, or using.
Access control is a method of guaranteeing that users are who they say they are and that they have the appropriate access to company data. At a high level, access control is a selective restriction of access to data.
The key to understanding access control security is to break it down. There are three core elements to access control. Of course, we are talking in terms of IT security here, but the same concepts apply to other forms of access control.
Identification: For access control to be effective, it must provide some way to identify an individual. The weakest identification capabilities will simply identify someone as part of a vague, poorly defined group of users who should have access to the system. Access control system can be linked with business user’s database and can identify employee/users for that group and based on that an access can be granted.
For an example, a normal user can only have access for Read data whereas Admin can have both Read & Write access.
2. Authentication: Identification requires authentication. This is the process of ensuring that the identity in use is authentic, that it is being used by the right person. In its most common form in IT security, authentication involves validating a password linked to a username. Other forms of authentication also exist, such as fingerprints, smartcards, and encryption keys.
For an example, when an user enters Username & Password, system will trigger another protective measures to ensure that right user has logged in, based on may be location that user has logged in or even by sending One Time Password to user’s registered mobile device.
3. Authorization: The set of authentication and linkage to user’s read/write or an execution permission can be triggered by system. Then only correct authorization based on user group can be granted.
For an example, there are different types of group of people (employee) working in an IT industry, one who need read access (such as telephone operator), one who needs read and write access (database management employee/developers), and also Admin who can delete/update the same in system. So, based on identification of user group, system will allow access to that category only (Read/Write/Execution).
Bottom of Form
