access control

PART A

The Personal Identity Verification (PIV) card is used in non-military government agencies for authentication and identification to gain access to systems, networks, and online resources. These cards, in combination with a personal identification number, meet two-factor requirements. PIV credentials also are designed to help reduce counterfeiting and are tamper-resistant.

An authenticator app, such as Google Authenticator, is another method to achieve two-factor authentication. It is a free app available for installation on mobile devices.

The U.S. federal government authorizes the use of PIVs as well as authenticator apps, depending on the circumstances.

Answer the following question(s):

In what type of situation would an authenticator app provide adequate two-factor authentication for federal government use? Provide rationale or a citation for your answer.

In what type of situation would a PIV be required for federal government use? Provide rationale or a citation for your answer.

Fully address the questions in this discussion; provide valid rationale or a citation for your choices; and respond to at least two other students’ views.

PAER B

The U.S. government classifies sensitive information into four main categories based on the degree of damage that would occur to national security if the information were disclosed in an unauthorized manner: Unclassified, Confidential, Secret, and Top Secret.

A typical classification scheme used by the private sector includes these categories: Public, Internal, Sensitive, and Highly Sensitive.

Answer the following question(s):

Why do you think the U.S. government does not typically use the Sensitive category?

What classification levels would a private company that works on government contracts use? Why?

PART C

Assignment: Implementation of an Information Classification Policy

Learning Objectives and Outcomes

Align information classification policies and controls for the execution of segregation of duties and access, based on least privilege.

Assignment Requirements

This assignment helps you develop an information classification plan to ensure the privacy and confidentiality of corporate information and ensure that public information is accessible by all.

You are provided with a worksheet named “Implementation of an Information Classification Policy” to complete this assignment. Before you begin this assignment, review all that you have learned related to information classification and access control.

For this assignment:

Complete the Information Classification Standard Matrix in the worksheet per the instructions and submit it for a grade.

Required Resources

Worksheet: Implementation of an Information Classification Policy (Classification Policy Worksheet)

Course textbook

Internet access

Instructions:

Review the information classification standard (Table 1) and the associated job roles list for Acme.

In the Information Classification Standard Matrix beginning on page 3, align the information classification standard with appropriate access control based on job roles.

Table 1: Acme Incorporated Information Classification Standard

Information Classification	Potential Impact	Types of Information
Public	None or limited Mention in local media No impact on operations, financial performance, or public image	Published documents, Web pages, newspaper advertisements, non-sensitive, information
Internal Use Only	Limited impact from negative publicity Slight image or financial harm not prolonged or severe in nature	Internal memorandums of operations, continuing contracts, private customer information, short-term operating results, and strategy
Confidential	More severe than limited Impact from negative publicity for up to six months Moderate image or financial harm of less than $5 million over 6 to 12 months	Critical and sensitive operating reports, personnel records, pay records, medical records, severe workforce management information, and periodic financial information reported to the public
Restricted	Severe impairment to public image and financial operations Impairs customer and public trust More than $10 million loss in three months Sustained negative publicity expected for one or more years Impairs ability to execute operation and strategic initiatives	Strategic plans, communications with the board of directors or with joint venture boards of directors, internal investigations, strategic expansion plans, and associated workforce management

Acme Incorporated Job Roles

Chief Executive Officer (CEO)*

Senior VP of International Acquisitions*

Executive VP of Marketing*

VP of Human Resources

Plant Manager

Southwest Region General Manager

Southwest Region Store Manager

Northwest Region Store Sales Clerk

Information Security Specialist

Customer

* Board members