Transcript:
A well-defined access control policy is needed in the network world that companies and organizations work in today. Consider network-based systems and how devices are connected to these systems. Consider the sensitivity levels of data and how the information on your devices could be vulnerable without well-defined access controls. Understanding the requirements that are necessary for a strong access control policy is essential in safeguarding your systems, critical infrastructure, and sensitive data. Let's discuss what you need to include within your access policies to control the access to your data and your systems without restricting the ability for your people to do their jobs. Your access control policies should include controls that are used to restrict reading, writing, processing and transmitting information, as well as the modification of information systems, applications, services, and communications configurations that provide access to your organization’s information. There are two different types of access controls. Logical access control and physical access control. Physical access control is restricting access to a location and tracking who is entering or exiting a facility using various security methods. Logical access control is defined in using restrictions for virtual access to data and consists of things such as user identification, such as logins and passwords, authentication to account management, authorization protocols to protect both software and hardware and access enforcement to principals like least privilege which is usually defined for roles and responsibilities. Finally, your access control policy should include controls based on a specific access control model. While there are four access control models, we most often look at the role-based or rule-based access controls. For role-based controls, your access control policy should be implementing controls based on the needs of an employee's specific role and what types of data or information they would need to do that job effectively. For rule-based controls, your organization should define access on the predetermined needs of specific systems, databases, or devices. To learn more about what to include in your access control policies, head to KirkpatrickPrice.com