Who should have access to your company's data? How do you ensure that those attempting access have actually obtained such access? Under what circumstances is access denied to a user with access privileges? To effectively protect your data, your organisation's access control policy must answer these (and other) questions.
What is access control?
Access control is a method of ensuring that users are who they say they are and have appropriate access to company data.
At a high level, access control is a selective restriction of access to data. It consists of two main components:
Authentication;
Authorisation.
Authentication is a technique used to verify that someone is who they claim to be. Authentication is not in itself sufficient to protect data. What is needed is an additional layer, authorisation, which determines whether a user should be authorised to access data or perform the transaction they are attempting. Without authentication and authorisation, there is no data security. It is therefore important that there is a constant trace of requests for access, transmission, copying, deletion and other manipulation of any kind on corporate data.