Discussion

12595Based on the readings this week, discuss some common strategies and pitfalls you have seen with both business continuity and disaster recovery plans. In your posting provide an example and strong mitigation strategy.

Rubric for this discussion assignment:
Synthesis of Concept
Applications/Reflections of Personal Experience
Clear Citations
Writing Standards

Access Control

The most effective way to secure sensitive data within the organization is through access control. These controls can be set in many different areas. From the operating system to the folders and files on your network, each implementation controls what the individual user can accomplish in your organization. Windows has built in access controls for accomplishing this seamlessly. Files and folders located on your data servers also require a form of access control by using authorization. Once a user authenticates to a system, they are then allowed a certain set of privileges that grant them access to specific sets of data. If would be unwise to allow payroll files to remain wide open to all employees of an organization, by creating Access Control Lists or ACL’s for short, you can restrict viewing these types of files to only those with a legitimate reason to work with them.

When you consider where the most damage can occur on your systems, the first thought should go right to your servers. An organization’s servers typically hold all of the data both sensitive and benign that make up the material from which the organization conducts its business. As you can imagine any attack compromising this data could have disastrous effects on the company. Access Controls can be tailored here to limit access to your systems based on need to have. There is never a good reason to give a user administrative access to their own workstation, as this would allow them the ability to change critical settings. When we consider production servers, the ACL lists should be quite limited.
The only way to know if the access control methods you have implemented into your organization actually work is to test them. This is something that can be done internally for most systems and for others you may want to hire a penetration team. A penetration team does exactly that, they attempt to enter your system undetected in order to give you an accurate assessment of your access controls and other security measures. It is much better to find these vulnerabilities now than during a real attack.