The importance of Access Control in a business environment
sarath_007
access_ppt15_l06.pptxAccess Control, Authentication, and Public Key Infrastructure
Lesson 6
Mapping Business Challenges
to Access Control Types
© ITT Educational Services, Inc. All rights reserved.
Page ‹#›
IS404 Access Control, Authentication and PKI (PKI)
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
1
1
Learning Objective and Key Concepts
Learning Objective
Apply various access control methods to solve a range of business challenges.
Key Concepts
Access control types
Access controls in relation to business challenges
Access control strategies to solve business challenges
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
2
2
Mapping Business Challenges to Types of Control
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
3
Disaster Prevention
Disaster Recovery
Customer Access to Data
Maintain Competitive Advantage
Define your subjects and objects
Categorize them into groups and roles
Determine who needs access to what
Determine whether any external subjects will have access to internal systems and data
Solving Business Challenges with Access Control Strategies
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
4
Employees with Access to Sensitive Systems and Data
Regulatory compliance
Privacy—either for customers or employees
Business continuity
Competitive advantage
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
5
5
Administrative Strategies
How will new accounts be created and new access levels be granted?
How will accounts be removed and access levels be lowered?
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
6
6
Technical Strategies
Discretionary access control (DAC)
Mandatory access control (MAC)
Role-based access control (RBAC)
Automated account review
Automated expiration of temporary access
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
7
7
Access Control Principles
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
8
8
Separation of Responsibilities
Least Privilege
Need to Know
Input/Output Controls
Input and output controls dictate a user’s ability to interact with devices and data.
The guiding principle for input and output controls is the same as everything else:
Users should have the least access possible to perform their job functions.
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
9
9
Contract strategic partner and legal requirements
Authentication methods, data classification, and data storage and recovery
Means of sharing data
Monitor access and violations
Service level agreements
Third-Party Considerations
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
10
Portability of SaaS
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
11
Mesh Network Topology
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
12
Summary
Access control types
Access controls in relation to business challenges
Access control strategies to solve business challenges
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
13
Virtual Lab
Configuring Windows Firewall
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
If your educational institution included the Jones & Bartlett labs as part of the course curriculum, use this script to introduce the lab:
"In this lesson, you learned about a variety of access control strategies available to an organization, such as physical security, technical controls, and the principle of least privilege. You also explored how designing an access control system helps meet business needs.
In the lab for this lesson, you will explore the capabilities of Windows Firewall, a type of technical control used in many businesses today. You will test the default configuration of Windows Firewall, configure Windows Firewall inbound rules to allow HTTP connections, and confirm that the new inbound firewall rule was configured correctly."
3/30/2015
14
