Access Control Policies

Access control is an important area of security policies that generally gives rise to some debate within organisations. Many arguments arise between users’ desire for unrestricted access to any data or resource on the network and the security manager’s measures to protect that data and those resources.

It is not possible to block users from accessing these resources or to lock every resource down entirely. On the contrary, the necessary permissions must be granted and minimum access must be allowed.

In fact, your aim in cybersecurity is to ensure that data is accurate, confidential and only available for use by authorised individuals/employees.

This is where the concept of least privilege comes into play. The idea is very simple and practical. Every user, including IT staff, should receive the minimum access needed to do their job effectively. Instead of asking “Why are you not giving this person access to X?”, you should be asking “Why should this person be given X access?” If you do not have a very good reason, withholding the access is the right course of action. This is one of the fundamentals of computer security. The more people who have access to any given resource, the higher the probability that some security breach will occur.

A common example involves sales contact information. Under normal circumstances, a company’s marketing department needs access to this data. But what could happen if competitors got hold of all of your company’s contact information? This means allowing them to start targeting your existing customer list and losing customers. At this point, a balance needs to be struck between security and access. In this situation, the approach taken is to give sales staff access only to contacts within their own territory/authority/pipeline. No one other than the sales manager should have access to the entire customer pipeline. The sales manager can present or grant access to relevant customer information to those they deem necessary. In the event of a data breach, data disclosure or hacking affecting a member of the sales team, the cyber incident will be managed with minimal damage.