The document summarizes LSE's access control policy. It outlines various access control methods used, including unique user accounts, complex passwords, physical access controls, privilege limitations, and file/folder permissions. It also discusses principles of least privilege, need-to-know, maintaining security levels for data, and authorization for remote users. The goal is to prevent unauthorized access to physical systems and logical networks while providing authorized users access to necessary information.

1. summary of paper:
Access Control Policy
Nouf Alrajeh 216006315
Bsmah AL-sahlee 216004072
Spring course 2019-2020
School of Business – Information
System Security

2. Induction
The London School of Economics and Political Science (LSE).Its public research university. The
main campus is situated in central London. First our course information systems security, refers to
the processes and methodologies involved with keeping information confidential, available, and
assuring its integrity. It also refers to Access controls, that it is goal to prevent unauthorized
personnel from entering or accessing a physical and logical systems. Also it is ensuring security
technology and access control policies are in place to protect confidential information.
the access control policy outlines the controls placed on both physical access to the computer
system (that is, having locked access to where the system is stored) and to the software in order to
limit access to computer networks and data. Access control policies provide details on controlling
access to information and systems, with these topics. That LES implements in networks, comms
rooms, IT systems, data and authorised users.

3. Policy LSE
Policy
Review and Development
ensure that it remains appropriate in
the light of any relevant changes to
the law, organisational policies or
contractual obligations. Additional
regulations may be created to cover
specific areas.
Principles
A principle which is a core
requirement of information security
for the safe utilization, flow, and
storage of information. LSE provide
for all employees, students and
contracted third parties with on-site
access to the information they need
Penetration tests
also known as a pen test, is a simulated
cyber attack against your computer
system to check for exploitable
vulnerabilities. That LSE’s use
Access control method
In order to protect assets in a company or
corporation, security analysts and programmers
can set access control to individual components
on a computer. These components can be the
operating system, programs or even hardware
settings.
Access control Authorization
Authorization is to make sure the
identity is who they say they are. We
run into it daily both in digital
(username or ID/password)
Access control is the addition of extra
authentication steps. proves they are
who they say they are
Policies, Codes of Practice,
Procedures and Guidelines
codes of practice, procedures and
guidelines are published together and are
available for viewing on LSE’s website. All
staff, students and any third parties
authorised to access LSE’s network or
computing facilities are required to
familiarise themselves
cloud system
LSE meet the access control provisions laid out
in this policy. Access controls implemented in
any cloud system is performed during the
vendor assessment and implementation stages
of any project

4. Principles
Generic identities: users of accounts must
be recognisable in order for LSE to meet
the conditions of its Internet Service
Provider will never be used to access
Confidential data or Personally
Identifiable Information, including data
supplied to LSE.
Privileged accounts:privilege rights shall be
restricted and controlled and not provided by
default. Privileged accounts must not be used
for standard activities; they are for program
installation and system reconfiguration, not for
program use.
Least privilege and need to know: Access
rights to both physical and logical assets. east
privilege" states that one should only have
access to what they need and nothing more.
Extend this idea to "confidentiality of data"
and you end up with "need to know".
Maintaining data security levels: Every
user must understand the sensitivity of their
data and treat them accordingly. Even if
technical security mechanisms fail or are
absent, every user must still maintain the
security of data.

5. Access Control Authorisation
 User accounts: for each user have unique user account and complex password in order to access to LSE IT resources
and services. HR and student information systems have basis of valid records that provides accounts. Any user is not in
either these systems. Must grantee access from via the appropriate staff or associate.
 Password: Formal process mange password issuing, strength requirements, changing and control. the IT Service Desk
mange password issuing for staff and IT Helpdesk mange password issuing for students.
 Access to Confidential, Restricted and Internal Use information: any authorized persons can access to information
that is require for his job or study. law and contract agreement with NHS Digital who determine these rules or the
Information Security Policy.. protect accessing to the information by use firewalls, network segregation and secure
log-on procedures. Public information have no access restrictions
 Policies and guidelines for use of accounts: LSE expect users to know LSE policies and guidelines , should
committee to them ,use them appropriately in the system
 Access for remote users: remote users need to take permitting from IMT to access to information. IMT do not
permitted to uncontrolled external access to any network device or networked system.
 Physical access control: in LSE campus you should have LSE Cards in order to Access to Comms Rooms

6. Access Control Methods
 Access Control Methods are the methods used for providing access control.
It prevent the collision or deal with it and ensures smooth flow of traffic on the network.
It is implemented at the data link layer of the OSI reference model.
 short list of access control methods used by default:
 user account privilege limitations.
 Windows share and file permissions to files and folders.
 server and workstation access rights. access rights.

7. Conclusion
LSE provide a lot of polies , guideline, Procedures
to users in order to protect and secure their
sensitive information as we study in Principles of
Information Security, security is the most important
process for each transaction in organization.

8. Slid share
– https://www.slideshare.net/BesssoEse/access-control-policy-176739390

9. Reference
– https://www.techopedia.com/definition/24840/information-systems-security-
infosec