Access is the ability to make use of any system resource. Access control is the process of granting or denying requests to:
• use information,
• use information processing services, and
• enter company facilities.
System-based access controls are called logical access controls. Logical access controls prescribe not only who or what (in the case of a process) is permitted to have access to a system resource, but also the type of access that is permitted. These controls may be built into the operating system, incorporated into applications programs or major utilities (e.g., database management systems, communications systems), or implemented through add-on security packages. Logical access controls may be implemented internally to the system being protected or in external devices. Examples of access control security requirements include account management, separation of duties, least privilege, session lock, information flow enforcement, and session termination.
Companies should limit:
• system access to authorized users,
• processes acting on behalf of authorized users,
• devices, including other systems, and
• the types of transactions and functions that authorized users are permitted to exercise.
The requirements for using – and prohibitions against the use of – various system resources can vary from one system to another. For example, some information must be accessible to al l users, some may be needed by several groups or departments, and some may only be accessed by a few individuals within the company. While users must have access to specific information needed to perform their jobs, denial of access to non-job-related information may be required. It may also be important to control the kind of access that is permitted (e.g., the ability for the average user to execute, but not change, system programs). These types of access restrictions enforce policy and help ensure that unauthorized actions are not taken.
Controlling physical access to company facilities i s also important. It provides for the protection of employees, plant equipment, hardware, software, networks, and data from physical actions and events that could cause serious loss or damage to the company. This includes burglary, theft, vandalism, and terrorism.