Subject: Cyber Security. Topic : Authentication, Authorization and Access Control.
42827Project 2
Scene 1
On your computer monitor, you read the meeting topic: “HR Data Access.” You think, “This might be a
tricky one.”
You remember a discussion with John, the CTO, about conflict caused by the sharing of information
between two departments. Grabbing your laptop, you head to the meeting.
Scene 2
In the conference room, John is already waiting. He says, “We will be joined by the VP of HR and the
managers of the Payroll and Training departments. Our focus will be on access to data that is housed in
the HR database.”
The door opens and the other three attendees walk in.
Amy Jones, the vice president of HR, begins: “The database that we use contains all employee data
ranging from payroll and benefits information to training and performance results. The issue that we are
facing, and that I hope you can help us alleviate, is that all departments within Human Resources have
full access to all of the data within the database.
“Recently, it was brought to my attention that the training department has access to payroll data.”
The two managers glance at one another.
John says, “I believe we can come up with a solution. As a matter of fact, this could be an opportunity to
also evaluate the risk level that the HR database has from outside threats.”
John turns to you: “I would like you to prepare a presentation for HR management.
“In this presentation, you will suggest how we might limit access to specific types of data and protect
vulnerable data from outside threats. Since we will be presenting to non-technical managers, you will
need to explain the difference between authentication, authorization, and access control in plain
language. The presentation will be scheduled in three weeks.”
After the meeting, you realize that while you might understand the problems of data access, other
employees may not be aware of the issues involving information access in an organization. Your
presentation will have to be understood by employees who do not have an information technology
background.
Organizations have two concerns surrounding access to data: They must limit access to data from outside the organization as well as control which people have access to what data within the organization. In this project, you will explain to management the difference between authentication, authorization, and access control and suggest how to keep outsiders from getting in and keep insiders from getting data they shouldn’t. During this project, you will research the various models for authentication, authorization, and access control. You will also be able to communicate the recommended solution to a nontechnical audience. This is the second of four sequential projects. There are 12 steps in this project. Begin by reviewing the project scenario, then proceed to Step 1.
When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission.
5.3: Support policy decisions with the application of specific cybersecurity technologies and standards.
6.2: Create an information security program and strategy, and maintain alignment of the two.
6.3: Integrate the human aspect of cybersecurity into an organization’s cybersecurity policy.
9.3: Assess policies, processes, and technologies that are used to create a balanced approach to identifying and assessing risks and to manage mitigation strategies that achieve the security needed.
Step 2: Explore the Basics of Authorization
Another topic you’ll need to be prepared to discuss is authorization. Define authorization and differentiate it from authentication (how are they similar, how are they different?). You will use the notes compiled in this step in your upcoming peer discussion. Complete each of the items listed below.
Define authorization and identify examples of authorization schemes.
Determine how access policies are used to express authorization rulesets. Identify key principles of access policies.
Identify the challenges that can arise when policies are used to maintain authorization rules. Identify solutions to mitigate these challenges.
Step 3: Explore the Basics of Access Control
One last topic to prepare for the upcoming discussion is access control: Define access control, then differentiate between access control, authentication, and authorization. You will use the notes compiled in this step in your upcoming peer discussion. You should describe the different access control models and how they are used, including, but not limited to, the list below. (Review Systems Software, Application Software, Software Interaction and Programming if you do not already have a working understanding of these topics.)
RBAC—Role-Based Access Control
MAC—Mandatory Access Control
ABAC—Attribute-Based Access Control
IBAC—Identity-Based Access Control
Step 4: Social Psychology Report
In Step 3, you explored the basics of access control and common models of implementing it. Your next task in preparing for your discussion with your peers is to consider the impact that human factors, such as ethics, legal issues, and psychology have on cybersecurity. To synthesize your research on these factors, you will write a report on the psychological aspects of cybersecurity. This report will be used to formulate your recommendations in Step 10 and be included as an appendix to your final presentation in Step 12.
In your report, do the following:
Explore the typical intrusion motives / hacker psychology. Classify the types of hackers and actors and give an example of a potential incident.
Define a cybersecurity policy as it relates to employees and employment. For example, how would an organization apply a security policy to employees and employment in relation to network-related programming or other cyber-related positions?
Define the separation of duties policy and give an example.
Define redundancy and diversity and explain how they relate to cybersecurity access control. Give an example of a policy integrating the concepts of redundancy and diversity to reduce risk.
Summarize how the implementation of the access control mechanisms mentioned in this section may have a positive or negative consequence on employee productivity.
Submit your report for feedback.
Submission for Social Psychology Report
Collepals.com Plagiarism Free Papers
Are you looking for custom essay writing service or even dissertation writing services? Just request for our write my paper service, and we'll match you with the best essay writer in your subject! With an exceptional team of professional academic experts in a wide range of subjects, we can guarantee you an unrivaled quality of custom-written papers.
Get ZERO PLAGIARISM, HUMAN WRITTEN ESSAYS
Why Hire Collepals.com writers to do your paper?
Quality- We are experienced and have access to ample research materials.
We write plagiarism Free Content
Confidential- We never share or sell your personal information to third parties.
Support-Chat with us today! We are always waiting to answer all your questions.
