Wireless Security.pdf - PDF Archive

CHAPTER 13
Managing Access
John Rittinghouse
James F. Ransome
Even the most secure of systems is vulnerable to compromise if anyone can just walk in,
pick up the computer, and walk out with it. Physical prevention measures must be used
in conjunction with information security measures to create a total solution. Herein, we
cover the essential elements every security administrator needs to know about access
control and management of passwords.
13.1 Access Control
According to the Information Systems Security Association (ISSA) [1] , “ access control
is the collection of mechanisms for limiting, controlling, and monitoring system access
to certain items of information, or to certain features based on a user’s identity and their
membership in various predefi ned groups. ” In this section, we explore the major building
blocks that constitute the field of access control as it applies to organizational entities and
the information systems these entities are trying to protect from compromise situations.
13.1.1 Purpose of Access Control
Why should we have access control? Access control is necessary for several good
reasons. Information that is proprietary to a business may need to be kept confidential,
so there is a confi dentiality issue that provides purpose to having access controls. The
information that an organization keeps confidential also needs to be protected from
tampering or misuse. The organization must ensure the integrity of this data for it to be
useful. Having internal data integrity also provides purpose to having access controls.
When employees of the organization show up for work, it is important that they have
www.newnespress.com