Access control
29.04.2020
Back to blog list
We all know very well that companies have their secrets as to the way they operate and that companies are always interested in the state of their security and potential losses. That’s what access control is for. Not every employee needs to know all the inner workings of every department and not every lowly employee needs to know the tricks of the trade and the more sensitive secrets that a corporation uses to achieve its success.
The way network access control works is that not everybody should have the authorization, for instance to give refunds. Because managers bear greater responsibility than rank and file employees, administrative rights access policy dictates the manager has more skin in the game and might be more worried about his numbers dipping that month. The access control system that hotels have also provides internet access and other service options to guests. In this case, they will be able to access particular options – the aforementioned convenience and room management privileges, but, according to access control policy, they will not be able to manage kitchen orders.
The difference between access rights and privileges is that access rights are a property of the object being accessed, for instance a file or a CD. Meanwhile, privileges are a property of the user. A file, for instance a program configuration file, may only be left to a paper company’s CTO to view and edit, rather than a customer service rep or a sales rep. All that a sales rep needs to know are the features and purchasing policies of that product, not how that product is technically produced and what the specific proportions of that product are. Therefore, this sales rep will not be privileged to view files depicting sensitive technological processes.
Role based access control is the mechanism that is built to allow or deny access based on these roles and privileges. User access control is a part of that as well, since not only must a user be prevented from accessing information that he does not need to know or edit, but users must also confirm compliance with policy. Policy verifications serve as important access rights management tools, since there is confusion sometimes in instructions and users are held accountable and have no excuse when they confirm that they’ve understood and will comply with the policy. Cancelling permissions or access rights becomes necessary in the event that an employee is exhibiting unusual activity or some unusual activity has been detected with respect to a particular object. For instance, in the event that unreasonable amounts of money are being spent on furniture for an office, the access rights to the books and the receipt copies regarding these objects may be restricted until an investigation is conducted.
Building access control systems is something that information security companies specialize in, thus taking the workload off the shoulders of the company which is probably already delegating as much as it can. In order to ensure that directions are concise and straightforward, that employees comply as much as possible with policy, to ensure that policy is established with respect to every possible risk, access control systems built by professionals is something that a company can greatly benefit from, as well as protect itself from liability.
