How Much Access Should a User Should Have
Let’s put the principles of integrity, confidentiality and availability into practice. Remember, we want to balance integrity and confidentiality (which both restrict access) with availability (which allows access).To do this we use the principle of least privilege. This means that we want to give an individual enough access so they can do their work, but no more.
An important related term is “need-to-know”, This term is used in government to help define what access an individual should be given. Let’s say I’m an FBI agent and I have Top Secret clearance. I gained this clearance by proving I was trustworthy through background checks and several years of service. Say one day I’m bored of my work and decide to look at what other Top Secret cases the FBI is investigating. Because of need-to-know, I can’t simply start browsing through files that aren’t related to cases I’m working on, even though I have Top Secret clearance. If I can’t convince my superiors that I need access to information, I will not be given that access. The same rules should apply in your organization. Just because someone works in accounting doesn’t necessarily mean they need access to all of your organization’s financial information. For example, an employee whose job is to buy inventory to sell likely does not need access to customer’s cardholder data, and should therefore be denied access to it.
It’s important for you to determine exactly what access a user needs. You need to make sure they’re allowed access to those things they need and locked out of everything else. The first thing you need to do is determine what access the user needs to do their job. You should get management involved in this process; management should sign off on a form that approves the specific access a user will be given.
As you are looking at what access a user needs to do their job, make a note of any information they will need access to read but don’t need access to write to. For example, an employee may need access to cardholder information to be able to process it, but would never need to change it. In this case, we would set permissions that would protect the integrity of the information. You should also determine if certain data can be retrieved via other employees when needed. For example, an employee may need access to certain financial data only once a quarter. An employee in accounting may work with this data every day and could provide a quarterly report to the employee that needs the data. On the other hand, it wouldn’t make sense to have an employee running to another employee every 10 minutes to get information they need to do their job.
Popularity: 12% [?]
