CERT Resilience Management Model, Version 1.0

ACCESS MANAGEMENTOperationsPurposeThe purpose of Access Management is to ensure that access granted to organizationalassets is commensurate with their business and resilience requirements.Introductory NotesIn order to support services, assets such as information, technology, and facilities must bemade available (accessible) for use. This requires that persons (employees and contractors),objects (such as systems), and entities (such as business partners) have sufficient (but notexcessive) levels of access to these assets.Effective access management requires balancing organizational needs against theappropriate level of controls based on an asset’s resilience requirements and businessobjectives. Insufficient access may translate into higher levels of asset protection but mayimpede the organization’s ability to use the assets to their productive capacity. On the otherhand, excessive levels of access (due to inadequate levels of control) expose assets topotential unauthorized or inadvertent misuse, which may diminish their productive capacity.Finding the right level of access for persons, objects, and entities so that they can performtheir job responsibilities while satisfying the protection needs for the asset is a process thatinvolves business owners, organizational units, and the owners and custodians of assets. Inessence, these parties must come to agreement on what level of protection is sufficient giventhe need to meet objectives. Access management encompasses the processes that theorganization uses to address this balancing act.Access privileges and restrictions are the mechanism for linking persons, objects, andentities (and their organizational roles) to the assets they need to perform theirresponsibilities. Access privileges and restrictions are operationalized (i.e., made operationalor implemented) through logical and physical access controls, which may be administrative,technical, or physical in nature and can be discretionary (i.e., at the will of the asset owner)or mandatory (constrained by policies, regulations, and laws).Access controls differ significantly from access privileges and restrictions. In the purestsense, an access control is the administrative, technical, or physical mechanism thatprovides a gate at which identities must present proper credentials to pass. Some examplesof access controls are access and security policies, access control lists in applicationsystems and databases, and key card and key pad readers for facilities. Access controls areestablished relative to the resilience requirements for an asset and service they protect—they are the mechanism that enforces the resilience requirements of confidentiality, integrity,and availability. When an identity presents an access request to an access control, and theidentity has the necessary credentials required by the control (i.e., is authenticated andauthorized to have the level of access requested), access is provided.Access controls are a key element of the protection provided to an asset and form asubstantial portion of the organization’s protection strategy for assets and services. Becausethe operational environment is constantly changing, it is difficult for an organization to keep106 | CMU/SEI-2010-TR-012