IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.8 Granting of (application/data) access
permissions
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators; persons responsible for
substantive tasks
Such access permissions determine which person will, on the basis of his/her
function, be authorised to use applications or data. The access permissions
(e.g. read, write, execute) to IT applications, parts of applications, or data,
depend on the function fulfilled by the given person, e.g. application
supervisor, scheduler, system program, application developer, system administrator,
auditor, data acquisition operator, desk officer. In any case, only so
many access permissions as are required for task performance (need-to-know
principle) should be granted. Enforcement of access rights must be through the
administration of rights of the IT system.
A variety of IT systems allow various privileges to be defined as group
privileges or as profiles (e.g. data acquisition operators). This definition
corresponds to the technical implementation of privileges allocated to a
function. It is beneficial for the administration of the privileges of an IT
system to compile such groups or profiles, thus considerably simplifying the
allocation and updating of privileges.
The person responsible in each given case must arrange for, and document, the
assignment of, and changes in, access privileges. Such documentation must
show:
- what function, in compliance with the separation of functions (cf. S 2.5
Division of responsibilities and separation of functions), is provided with
what access privileges;
- which groups or profiles are in place;
- what person performs what function;
- the access privileges granted to a person; and
- the conflicts entailed by the granting of access privileges to persons. Such
conflicts may, for instance, result from incompatible functions being
performed by one person or from the fact that, depending on the given IT
system, it is not possible to separate certain access privileges.
Additional controls:
- Does up-dated documentation on the granted access privileges exist?
- Are requested access privileges or changes to granted access privileges
being confirmed or verified by the responsible persons?
- Is there a standard procedure for granting and revoking access privileges?
The approach to the separation of functions and granting of privileges is
illustrated in the following example.
The IT application considered here is a system for travel expenses accounting.
The relevant rooms are shown in the graph below. The IT system consists of a
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000