Access Control Management

Introduction

Access control management is the one of the most important features in keeping an organization’s assets secure. Controlling access to a firm’s physical and technological assets can become very complex depending on the size and range of the firm. Access Control defined by Techopedia, “a way of limiting access to a system or to physical or virtual resources.” (Access Control, 2014)

In order to analyze the technologies of access control management, we must first describe the key principles of security and how they evaluate access control technologies. Known as the information security CIA triad, confidentiality, integrity, and availability are the benchmarks for evaluating security access controls. Addressing each of these principles whenever during implementation of a new access control model will ensure the security of the assets of the organization.

Access control management depends on identification, authentication, and authorization. Identification is the way a person is recognized as a supplicant or subject. A supplicant is an unverified entity that is seeking access to an object. An object is an asset the company owns and has access controls in place to use. The identification can come from many different methods such as ID cards or smart cards, biometric devices, pin number, and usernames. Once an ID has been mechanism has been address the process of authentication begins. Authentication validates the supplicant’s identification by using one of three authentication factors; something the supplicant knows which could be a password or passphrase, something the supplicant has which could be a smart card, or something the supplicant is, a biometric device. Some access control systems may require more th...

... middle of paper ...

...untry laws may limit the number of records that can be viewed by one if its employees. This means, a banking employee may have access to their own customer base but they should not be allowed access to the same type of customers in a branch in other country. (Rjaibi & Bird, 2004, August) Mandatory access controls do not limit based on attributes associated with an object, physical location in this example. There for a classification label on the object, customer account, and clearance level label of the subject, bank employee, would not limit the bank employee from access the customer account based on the attribute of physical location. The availability and confidentiality principle is not completely covered by mandatory access controls because access cannot be determined based on attributes in this model and could allow access where access should not be given.