Audit Controls Paper

Audit Controls Paper
1) The importance of access controls in addition to audit controls.
In addition to audit controls, access controls are important because they help reduce the risk of
internal data breaches by preventing unauthorized work staff to have access to ePHI. "Only
individuals with a "need to know" should have access to ePHI" (Brodnik, Finehart–Thompson, &
Reynolds, 2012, p. 304). Additionally, Brodnik et al., (2012), states that access controls are used to
aid in the authentication, audit and authorization process by implementing unique specifications
such as: a unique user identification number, emergency access procedures, having an automatic log
offs, and by having unique specifications within the system that allows for encryption and
decryption ... Show more content on Helpwriting.net ...
Different types of technical control methods for person or entity authentication are password (with a
username or personal identifier), smart card, token, key or biometrics (Brodnik et al., 2012, p. 305).
That said, the best form of authentication that best meets the Person or Entity Authentication
standard for different healthcare applications is by having a combination of user identification along
with a password (AHIMA, 2010). Person or entity authentications are necessary to verify a person's
identity and is best used when individuals are accessing ePHI. Utilizing a combination of a
password and identification enforces stricter security measures by ensuring users are being
identified and authenticated before using an
... Get more on HelpWriting.net ...

Unit 3 Assignment 1: Remote Access Control Policy...
Richman Investments has decided to expand their business. We have been given their new growth
projections of 10,000 employees in 20 countries, with 5,000 located within the U.S. Richman has
also established eight branch offices located throughout the U.S. and has designated Phoenix, AZ
being the main headquarters. With this scenario, I intend to design a remote access control policy for
all systems, applications and data access within Richman Investments. With so many different
modes of Access Control to choose from it is my assessment that by choosing only one model would
not be appropriate for Richman Investments. My recommendation would be a combination of
multiple Access Control Models that overlap to provide maximum coverage ... Show more content
on Helpwriting.net ...
Constrained User Interface incorporates similar concepts of two other access control models that
have been detailed, Role Base and Rule Base. Constrained User Interface is defined as a user's
ability to get into certain resources based on the user's rights and privileges. These rights and
privileges are restricted and constrained on the asset they are attempting to access. While this
requires many levels of protection it provides limitations on the request access to the resources
available within the organization. Another example of a access control model that can be applied in
this situation is known as the Clark and Wilson Integrity Model. This model provides improvements
from the Biba Integrity Model of access control. Developed by David Clark and David Wilson, the
mode concentrates on what happens when a user tries to do things they are not permitted to do,
which was one flaw of the Biba Integrity Model . The other flaw that was addressed was the model
also reviews internal integrity threats . There are 3 key elements of the Clark and Wilson integrity
model; the first it stops unauthorized users from making changes within the system. The second, it
stops authorized users from making improper changes, and the third, it maintains consistency both
internally and externally . Within the Clark and Wilson model a user's access is controlled by

Access Control Models
ACCESS CONTROL MODELS
An access control model is a framework that dictates how subjects access objects. There are three
main types of access control model mandatory access control, discretionary access control and role–
based access control.
Discretionary (DAC) The creator of a file is the 'owner' and can grant ownership to others. Access
control is at the discretion of the owner. Most common implementation is through access control
lists. Discretionary access control is required for the Orange Book "C" Level.
Mandatory (MAC) Much more structured. Is based on security labels and classifications. Access
decisions are based on clearance level of the data and clearance level of the user, and, classification
of the object. Rules are made ... Show more content on Helpwriting.net ...
Network architecture – Logical controls can provide segregation and protection of an environment.
I/P address ranges, subnets, routing between networks, etc.
Network Access – Logical network access controls – routers, switches, NICs, bridges.
Encryption and Protocols
Control Zone – Technical and physical control. Surrounds and protects network devices that emit
electrical signals. TEMPEST related.
Access Control Types
Each control method can also perform different functionality. The functionality types are
Preventative
Detective
Corrective
Deterrent
Recovery
Compensating
For example

Preventative–Administrative
Policies and procedures, effective hiring practices, background checks, data classification, security
awareness training.
Preventative–Physical
Biometrics, badges, swipe cards, guards, dogs, motion detectors, fences, mantraps, locks and alarms.
Preventative–Technical
Passwords, biometrics, smart cards, encryption, call–back systems, database views, antivirus
software, ACLs, firewalls, IDS
Auditing
Accountability Auditing capabilities ensure that users are held accountable for their actions, verify
that policies are enforced, deter improper actions and are an investigative tool.
There are 3 main types of audit tool
Audit reduction
Variance detection
Attack–signature detection
Audit data must be protected from unauthorized viewing and

The Disadvantages And Disadvantages Of A Single Sign-On On...
Name: Mojeed Oyeniyi
Assignment
1. What is Single Sign–On? What are the advantages and disadvantages of it
Single sign–on (SSO) is a property of access control of multiple related, yet independent, software
systems. It is a strategy that allows users to sign on to a computer or network once and have their
identification and authorization credentials allow them into all computers and systems where they
are authorized. Hence, users do not need to enter multiple user IDs or passwords which invariably
reduces human error, which is a major part of system failures
Advantages of Single sign–on
Increased efficiency and productivity – It brings about efficient logon process as users only have to
log on once.
It provides failed logon attempt thresholds and lockouts which protects against an intruder using
brute force to obtain an authentic user ID and password combination.
It can provide for stronger passwords. With only one password to remember, users are generally
willing to use stronger passwords.
When businesses have various partners, implementing authentication and authorization can become
somewhat complicated. With Single sign–on, businesses can centralize authentication management
and grant users instant access to all shared applications.
Disadvantages of Single sign–on
A major disadvantage is that it constitutes a single point of failure. A compromised password lets an
intruder into all areas open to the password owner.
Static passwords provide very limited security. Two–factor authentication or at least a one–time
password is required for access by the user using SSO
Adding SSO to unique computers or legacy systems in the network might be difficult.
2. Why is Media Disposal important? What are the bad outcomes that can be done if not performed
Media Disposal is the destruction of data on electronic equipment being disposed, transferred or
reused. This includes all forms of electronic media such as hard drives, solid–state and flash drives,
tapes and devices with built–in storage. Media that is to be discarded must be sanitized in a manner
that makes access to previously stored data impossible. Degaussing and repeated overwriting are
common and effective methods of disposing media that are to

Management Access Control At Lan Essay
Introduction:
Several buildings spread across a local area network with hundreds or thousands of devices ranging
in size from single office computers, a computer network LAN stands for. The main role of LAN
computers linked together and to share access to printers, fax machines, data storage, messaging,
games, file servers, and other services. LAN aspect of the development of the school, the university,
the office building to operate as a small geographic area, quick data transfer.
LAN common share data devices in the world today are major large–sized businesses, and the
interaction between the role and the lower its cost. LAN 's data can be transmitted at rates faster than
the speed of the telephone line, and have the ability to transmit data; But the distances are limited.
Management level in a LAN configuration and the type of equipment involved in the running no
need to manage access to it over the network, and it is important to protect the network from
hacking and virus attack.
Management Access Control at LAN :
Access control to the main function and that is to control the members of the network LAN to use
the data from the area. LAN users do what they can access resources on a system; they specify what
activities it offers management. For example, there are several sections of a company; Marketing, IT
marketing and accounts of the users do not need access to the data by the IT department and so on.
Access control model:
Different types of access control to protect a

Access Control Policy
Associate Level Material
Appendix F
Student Name: Charles Williams
University of Phoenix
IT/244 Intro to IT Security
Instructor's Name: Tarik Lles
Date: December 4, 2011
Due in Week Seven: Outline the Access Control Policy. Describe how access control methodologies
work to secure information systems
Access control is used to restrict operations, which authorized users can perform. Access control
does exactly what it says, it controls what access an authorized user can have. A reference monitor is
used for access control and follows instructions from an authorization database. These
authorizations are controlled and administered by a security administrator who sets ... Show more
content on Helpwriting.net ...
It is also possible under some operating systems for the network or system administrator to dictate
which permissions users are allowed to set in the ACL's of the resources. Discretionary Access
Control has a more flexible environment than Mandatory Access Control, but also increases the risk
that data will be made accessible to users who should not gain access. Understanding permissions
about the security of file servers on the network will increase network security (Bushmiller, 2011).
2 Mandatory access control
Describe how and why mandatory access control will be used.

Mandatory Access Control (MAC) uses a hierarchy approach to control access to resources, such as
data files. The system administrator is responsible for the settings in a MAC environment. All access
to resource objects is controlled by the operating system based on setting configured by the system
administrator. With MAC it is not possible for users to change the access control for any resource.
Mandatory Access Control starts with security labels, which contain two types of information and
are assigned to all resource objects on the system. The two types of information are classification,
such as confidential or top secret and a category, which is basically an indication of the project or
department to which the object is available, or an indication of the management level.

Information, Network And Cyber Security
CANDIDATE NAME: NAZIFI IDRIS KHALID
STUDENT NUMBER: C1473542
MODULE CODE: CMT 104
MODULE TITLE: INFORMATION, NETWORK AND CYBER SECURITY
SEMINAR TUTOR: DR. PETE BURNAP
ESSAY TITLE / COURSEWORK: COURSEWORK
WORD COUNT: 1500
Review of Existing Literature:
The most important goal of any access control model is to provide a verifiable system that
guarantees the protection of any information from being accessed by an unauthorised party; in line
with some defined security policies (Ausanka–crues 2006). Many access control models have
evolved over time that manage access to resources in the organisation. With each one leveraging on
a particular element of security. The Bell– Lapadula model for example focuses on Confidentiality;
while the Biba ... Show more content on Helpwriting.net ...
The User does not have any privilege to change or modify his setting or access level to any party.
On the other end, Discretionary Access Control Model gives the User all the rights and privileges
over any object on his profile including all the programs associated with it. This means that the User
can be able to modify security settings and privileges for others. This of course is very flexible at the
expense of security rigidity. Which in turn may lead to misuse or abuse of privilege which is a major
setback for this model. Rule Based Access Control is administered based on some predefined rules
set by the Systems Administrator for each User. This means that there are as equal the rules set as
the number of Users in the Organisation. This eventually becomes cumbersome as the number of
Users gets larger.(Anon n.d.). The Role Based Access Control is based on the user's role or job
functions. Permissions are granted to the role and not the individual. For example if the user
performs role of a Deputy Manager, he is mapped to the role of a Deputy Manager. And thus He
shares a common role with any other User of the same position in the same Organisation. This
access control model offers more flexibility and ease of Management to the Administrator from a
central location; as there are fewer roles to manage as compared to the number of Users. Context
Aware Access Control takes into consideration the context information of

Access Controls And Access Control
This chapter is basically based on access control in regards to computer information security. Access
control is seen as the fundamental mechanism put in place to help make information security
successful. Access control feature, in a particular system, will control how users can communicate,
access and modify system resources and programs. Access control was described in this chapter as a
very useful tool for the computer information security because it helps with ensuring that
unauthorized person or program have no access to what they are not supposed to. Access control is
regarded as the first line of defense to control, protect and monitor organization's resource's
availability, confidentiality and integrity.
Furthermore, this chapter illustrates how users can be granted access to network resources. It
explained that for a user to be allowed access to a network he must satisfy the condition of
identification and authentication. The identification part could be something of user ID, name or
account number. The identification key is not enough to grant access, but it's simply a way of
introducing yourself by saying who you are. Then, at that point the system will request for you to
authenticate yourself (confirm who you said you are) by requesting for an authentication key. The
authentication key could be password, passphrase, personal identification number (PIN), or a token.
Once, the authentication is verified and the system found it to be correct, then access will be

Improving Personal Health Records On Cloud Services
In the medical industry, it is critical to ensure the confidentiality of patients' personal health records
when storing and managing them. Before cloud computing surfaced, heath providers used local
servers and hard drives to store their records and data. As cloud computing has been becoming more
and more popular, many healthcare providers are using the cloud to store and manage their sensitive
data. This paper will investigate the different access control models, Role–Based Access Control and
Attribute–Based Access Control, to validate the confidentiality of data when storing and managing
personal health records on cloud services. The competitive evaluation of the access control models
will be done to identify possible flaws in these ... Show more content on Helpwriting.net ...
1.1 Personal Health Record
A personal health record is a record of medical data or information pertaining to a particular
individual that is managed and maintained on a system, in this case a cloud system. This system is a
centralized place where the individual can store and manage their health data wherever and
whenever they wish as long as there is a connection to the internet present.
1.2 Cloud Computing
Cloud computing is the practice of storing, managing, and processing data on a network of remote
servers hosted on the internet, instead of locally on servers or hard drives. Cloud computing has
unlimited storage, capacity and scalability, as well as back up and recovery systems. It allows you to
access your data anywhere with an internet connection. However, security and privacy is a concern
when managing confidential data.
1.3 Data Confidentiality
Confidentiality is denoted as securing a system to protect sensitive data from being exposed to the
unauthorized user. Confidentiality is extremely important when data is stored on a cloud server
remotely. The data owner is not aware of where their data is stored and of who is able to access their
personal data leaving concerns of how confidential their data actually is.
1.4 Access Control
Access control is the technique to ensure security in a system. To

Summary: Mandatory Access Controls
This week the company's Chief Security Officer (CSO) tasked the IT security and audit group with
auditing the company's current IT system configuration policy and system settings with an emphasis
on access control configurations. In a multiple user environment, such as our company and its
various business units it is important that the appropriate access restrictions enforce the least
privilege model to ensure that employees can only access the data needed for their particular job
functions and roles. Without these security configurations and access controls in place, it could be
possible for employees to access corporate or customer information when they do not have a valid
need. Our security audit will require a detailed analysis of the ... Show more content on
Helpwriting.net ...
In the business case where you have highly sensitive systems where you need to limit access, you
would want a more granular control mechanism such as DAC. The administrative overhead for
managing a DAC approach also suggests that its application of controls must be limited to a smaller
subset of systems or physical access systems. For the overall business justification or case with
regards to IT system and data access, an RBAC approach would make more sense. "Due to its
flexibility, ease of administration and intuitiveness, RBAC has been successfully adopted as a means
to enforce security by many organizations. Recognizing the industry needs, RBAC has been widely
deployed in most commercial software including operating systems, database systems, enterprise
resource planning and workflow systems" (Uzun, Atluri, Vaidya, Sural, Ferrara, Parlato, &
Madhusudan, 2014). For a business with minimal security risk concerns and no regulatory
requirements, there would not be a real business justification for implementing a DAC architecture,
and it would not be recommended. The better approach in this example would be an Enterprise
RBAC architecture deployment. It would be the most cost efficient and less intensive control to
implement. Another possible use case for an Enterprise RBAC

Definition Of Administrative Access Controls Essay
1. Administrative access controls "define the human factors of security" (Red Hat, n.d.). An example
would be having mandatory training before getting access to a certain room. If you do not complete
the training, then you will not have access. Other examples of administrative access controls include
personnel registration, recovery plans, and disaster preparedness. Physical access controls are "the
implementation of security measures in a defined structure used to deter or prevent unauthorized
access to sensitive material "and include restricted access rooms that require a badge, password, or
some other special permission to enter (Red Hat, n.d.). An example of this would be not related to
computers is a barhop standing at the door making sure only 21+ adults enter. In a computer or
business example, this could be only letting the IT guy have access to the data center. He would
have either a special card to let him in or he would have to make a phone call and use a special
passphrase to be granted access into the otherwise locked room. Technical access controls use
"technology as a basis for controlling the access and usage of sensitive data throughout a physical
structure and over a network " (Red Hat, n.d.). They include "tools used for identification,
authentication, authorization, and accountability. They are software components that enforce access
control measures for systems, programs, process, and information" (Harris, 2012). Technical access
controls are

Information Security Policy
Axia College Material Information Security Policy Axia College IT/244 Intro to IT Security Dr.
Jimmie Flores April 10, 2011 Table of Contents 1. Executive Summary 1 2. Introduction 1 3.
Disaster Recovery Plan 1 3.1. Key elements of the Disaster Recovery Plan 1 3.2. Disaster Recovery
Test Plan 1 4. Physical Security Policy 1 4.1. Security of the facilities 1 4.1.1. Physical entry
controls 1 4.1.2. Security offices, rooms and facilities 1 4.1.3. Isolated delivery and loading areas 2
4.2. Security of the information systems 2 4.2.1. ... Show more content on Helpwriting.net ...
For example a clerk will only be able to access a limited amount of information, such as inventory at
each store. The limitations will be different for an accountant or the mangers. All information will
be protected with several different layers of security. The first layers will be simple hardware
protection for access to the network; from there the security will increase with password protection
and restrictions to users. (Merkow & Breithaupt 2006) 2 Integrity Each user will be granted
password access to required information. The network will not allow external access from users or
computers not tied into it. Higher levels of access will also involve hardware such as smart cards or
fobs for access to data and only be able to access data from a central location. (Merkow &
Breithaupt 2006) All transactions and account information will be centralized with limited
accessibility. 3 Availability The new system for Sunica will be defined by a formal outline and
written guidelines for each employee. The entire system will be tied into a network that is accessible
by every location, no remote access other than specified locations will be allowed. The entire
network will be tied into cloud based storage for backup and recovery, all sensitive and important
data will be located offsite, yet

Application Of Access Control System
Introduction
Access control is one of the earliest problems in computer security and remains a continuing
challenge. Access control component determines whether requests to access resources are granted.
1. Discretionary access control
In Discretionary Access Control any user can set an entrance control instrument to permit or deny
access to an object. DAC relies on the object proprietor to control access. It is generally executed in
most working frameworks, and is very familiar access control method. Flexibility is a strength of
DAC and a key motivation behind why it is broadly known and actualized in standard working
frame.
Unlike Mandatory Access Control (MAC) where access to framework assets is controlled by the
working framework ... Show more content on Helpwriting.net ...
A discretionary access control (DAC) arrangement is a method for appointing access rights in light
of tenets predetermined by clients. This class of approaches incorporates the record consents model
actualized by almost every single working framework. In Unix, for instance, a catalog posting may
yield "... rwxr–xr–x ... file.txt", implying that the proprietor of file.txt may read, compose, or
execute it, and that different clients may read or execute the document yet not compose it. The
arrangement of access rights in this case is {read, compose, execute}, and the working framework
intercedes all solicitations to perform any of these activities. Clients may change the consents on
documents they possess, making this an optional strategy.
A system actualizing a DAC approach must have the capacity to answer the inquiry: "Does subject S
have right R for item O?" Abstractly, the data expected to answer this inquiry can be spoken to as a
scientific connection D on subjects, protests, and rights: if (S, O, and R) is in D, then S has right R
for article O; generally, S does not. All the more basically, the same data could likewise be spoken to
as an entrance control network. Every column of the grid relates to a subject and every segment to
an article. Every cell of the framework contains an arrangement of rights.
Example file1 file2

Essay on It244 Access Control
1. Access Control Policy
1.1. Authentication
Describe how and why authentication credentials are used to identify and control access to files,
screens, and systems. Include a discussion of the principles of authentication such as passwords,
multifactor authentication, biometrics, and single–sign–on.
Authentication credentials are used to control access to sensitive data or systems by making it hard
for people to get into the system who shouldn't have access. Passwords and usernames are a good
start because if they are kept secure, they are generally very hard to bypass. If they are bypassed by
some method ... Show more content on Helpwriting.net ...
Whoever has the responsibility to keep the data safe is probably the one responsible for dictating
access.
1.2.2. Mandatory access control
Mandatory access is used to authenticate actions between a subject and an object. In order for a
subject to access an object it must pass a set of authentication rules.
1.2.3. Role–based access control
Describe how and why role–based access control will be used.
RBAC is a very efficient way to control access to resources. This is because access is granted to
select roles based on what the needs each role has to complete its job. Then, the person or program
is assigned to the role and thus will only be granted the access granted to the role they are assigned.
1.3. Remote access
Describe the policies for remote user access and authentication via dial–in user services and Virtual
Private Networks (VPN)
The policies for remote access, authentication via dial–in user services, and VPN's has to be more
strict than with general authentication and access within the work place. While there are ways for a
hacker to get into the system while following the usual work place policies, it would probably be
much easier to get in by one of these methods. When accessing resources remotely it is important to
have added authentication methods such as security questions or possibly some kind of portable
biometric device which can scan a part of the user and then send

Access Controls Provide A Mechanism
Introduction
Access Controls provide a mechanism, which allows an administrator to ensure that appropriate
techniques are in place to control how users interact with an IT system. It provides an avenue where
restrictions can be developed, specifying what a user can do, the resources they can access, and the
functions they can execute on a system. It is aligned with the three main security principles;
confidentiality, integrity and availability. This alignment ensures that data and resources within an
IT system will remain confidential as required, the structure will remain intact and these objects will
remain available, so as not to diminish the functionality of the system. Access controls that are
incorporated into a security plan are ... Show more content on Helpwriting.net ...
One of the difficulties in managing this access arises from the need to provide a variety of user's
access, each requiring a different type of access to the system. For the sake of security, the need to
manage this access should be defined by one or more of the following frameworks; Role Based
Access Control (RBAC), Discretionary Access Controls (DAC), Mandatory Access Control (MAC),
and Mandatory Access Control (MAC).
Statement of Purpose
The current state of the organization's access control management system is consistent with that of
the DAC model. A recent move to outsource certain business practices and continued organizational
growth has created an environment where increases in employee hiring's and employee turnover are
inevitable. An analysis of various methods of access control has been requested, so that we can
better understand how specific access control attacks are perpetrated and their origin. Information
will be collected and then analyzed in order to substantiate any recommended changes to the current
access control configurations. RBAC, DAC, and MAC will be compared and contrasted, in order to
gain insight, as to how each plays a role in reducing the risk to a system, along with identifying the
strengths and weaknesses of each. These results, along with a detailed recommendation will be
presented to executive management, in order to generate the necessary support for altering the
current program

Questions On Database Security And Database Systems
DATABASE SECURITY
Submitted to the Faculty of American Public University
By
Loren Robert Hensley
In Partial Fulfillment of the
Requirements for the Course of INFO620 Enterprise Database Systems
November 2014
American Public University
Charles Town, WV Abstract
This paper explores the different aspects of security as it pertains to database systems. It will provide
an overview of security concerns such as access control, user authentication, reliability and data
integrity, as well as how IT professionals might mitigate the risk associated with each. By examining
the methodology by which attacks on database systems occur, we are able to take a comprehensive
approach to prevent or limit the extent of such attacks and the impact they may have on a DBMS
environment. Finally, we will review industry best–practices of the implementation of security
countermeasures.
Introduction Over the past ten to fifteen years, there has been tremendous growth in the utilization
of database systems. One reason for this is because of the growth E–Commerce has experienced.
Businesses must have a reliable method of storing a customer's information safely and efficiently.
We often hear of a data breach which results in customers' credit card information being stolen.
There are inherent risks associated with storing financial information in an online capacity, such as
hackers and ill–intentioned employees. Given the diverse nature of the interconnectivity of these
systems, there is a

Access Control Models And Report Essay
Nisy John
Student Id: 1304866
Information Security Research Report
Lecturer: Krassie Petrova
ACCESS CONTROL MODELS
Report Synopsis This research is aimed at conducting a comparative study of the different access
control models and report on them. The prescribed text mentions Role Based Access Control in
chapter 5 but does not give details on this model and does not provide information on the other
access control models. Hence this report seeks to explain the different access control models and
compare them based on an analysis of academic literature.
Introduction Information security refers to protection of information against unauthorised access
whether in storage, being processed or in transit. The major goals of information security are
confidentiality, integrity and availability. In order to meet these security goals, several access control
models have been proposed. Access Control is the control of access to data, system and dialogues
based on certain policies. Access control models were traditionally classified as Discretionary
Access Control and Mandatory Access Control. However several newer models have since arrived
such as I–BAC (Identity Based Access Control), RBAC (Role Based Access Control Model), ABAC
(Attribute Based Access Control), TBAC (Task Based Access Control) and T–MAC (Team Based
Access Control) (Joshi, Aref, Ghafoor & Spafford, 2001).
Research Process and Scope The research process is to find relevant academic articles on access

Application Computing For The Distributed Computing Essay
There are sure advancements that are working behind the distributed computing stages making
distributed computing adaptable, dependable, and usable. These advances are recorded beneath: 
Virtualization  Administration Oriented Architecture (SOA)  Framework Computing  Utility
Computing 2.5.1Virtualization It is a procedure, which permits sharing single physical occurrence of
an application or asset among different associations or occupants (clients)[2]. Fig 18 Virtualized
Cloud model 2.5.2 Service–Oriented Architecture (SOA) Administration Oriented Architecture
utilizes applications as an administration for different applications in any case the kind of seller,
item or innovation. In this way, it is conceivable to trade of information between utilizations of
various sellers without extra programming or rolling out improvements to administration. Fig 2.19
Cloud_computing–service_oriented_architecture 2.5.3 Grid Computing Lattice Computing refers to
distributed computing in which a gathering of PCs from different areas are associated with each
other to accomplish regular target. These PC assets are heterogeneous and geologically scattered.
Framework Computing breaks complex tasks into little pieces. These littler pieces are appropriated
to CPUs that dwell inside the matrix. Fig.20 Grid Computing 2.5.4 Utility Computing Utility
computing depends on Pay per Use model. It offers computational assets on interest as a metered
administration. Distributed

Database Security And Protection, Sql Injection...
Database security and protection is a significant concern for organizations across the world,
evidenced by the number of reported incidents with regards to unauthorized exposure to sensitive
information. As the amount of data that organizations collect, retain and share continues to escalate,
so does the importance of having a strong database security. The Privacy Rights Clearinghouse, a
website that keeps track of data breaches that were reported by companies, according to its research
more than 159 million records were breached in 2015 through the course of 226 separate breach
events. With the loss of unprotected data, can result in steep expenses for a company such as legal
fees, call centers, customer losses, and the ambiguous amount of bad publicity. A Forrester Research
survey concluded that an average security breach can cost a company between $90 and $305 per lost
record. Given the increase number of data breaches, there is a corresponding need to properly plan
ways to better protect and monitor the database systems through access control, SQL injection
prevention, and encryption of data.
Access control allows specific users either privileges or restriction of access to objects in a database
system. A Data Base Administrator (DBA) must take in specific consideration pertaining to which
users can see what tables, and perform certain data actions among those specific tables. Access
control can be defined in three ways: Mandatory Access Control (MAC), Discretionary

Denial Of Service ( Dos )
QUESTION ONE:
Denial of Service (DoS) is a type of a computer security threat that is designed to attack a network
and cripple it by flooding the network with useless traffic. A Dos attack exploits vulnerabilities in a
TCP/IP implementation or targets specific operating systems or even specific computer applications.
A DoS attack aims at ensuring authorized users do not have access to system resources. Common
DoS attacks include buffer overflow, ping of death, smurf attack, TCP SYN attack and Teardrop
attack (Gollmann, 2012). In August 2009, Twitter was hit with a DoS attack that shut down the site
for two hours, silencing millions of users and affected users around the world. The effect of this
attack meant that the users could not ... Show more content on Helpwriting.net ...
Establishment and maintenance of password policies for highly privileged accounts and regular
backup schedules and policies are important for system configurations. Tools like Tripwire to detect
alterations in configuration data or other files are used.
Investment of fault–tolerant redundant network configurations and machines for replacement of
similar machines if it is disabled helps in preventing DoS attack since services are restored quickly
(Gollmann, 2012).
QUESTION TWO:
a.) Role–Based Access Control (RBAC)
RBAC is a method used to regulate access to a computer or network resources or systems that is
based on various roles of individual users within an organization. RBAC prescribes whom or what
process has access to a specific network resource and the type of access that is allowed. The best
environment for this model is in an organization with clear defined goals based on how an
organization operates including input from a wide range of users in the organization. RBAC allows
for access rights grouping by role name with the using of resources restricted to individuals
authorized to the associated role. An example of using the RBAC is in a hospital information
management system. The roles of such a system are divided into roles such as the role of the doctor,
the role of a researcher, and the role of a laboratory technician. The role of a doctor includes
performing diagnosis,

Questions On Networked Information Systems
COMP2410 Networked Information Systems Assignment 2: Part 1 Aiden Ahn (u5458942) Sam Ye
(u1111111) Introduction Zxcasdqwe Question 1 Objective: To find out the risk of customers using
bank accounts and provide methods for mitigation of the highest priority residual risk. Constraint:
Stakeholders: Customers (primary), the bank, thieves Assets: Money Threats & vulnerabilities The
nature of all these threats are caused by unauthorised person to access the data that they don't have
the right to view/alter. Pay by tap credit cards: This is a permanent physical data storage mean where
all credential data is on it, it's kind of like a black box container where you can use the information
store on this piece of object, since this kind of object is easy to steal by an entity, therefore it should
be considered as a threat. ATM: ATM is a physical embed–in device which is to be installed on the
wall as part of the supporting infrastructure, despite of the fact that is unmovable, it is possible that
any third party scam devices is installed on the it by an intruder, such device includes hidden
camera, fake PIN pads and card skimmers. These data collection devices can retrieve your personal
private information quickly if you trigger them by the way they want. Online bank: Since this
process is done by the internet, then various of threats can be caused. Viruses/Malwares: This
includes downloading a spamming software (malware/backdoors), open unknown source emails

It 244 Appendix F Essay
Axia College Material
Appendix F
Student Name: Katelyn Sims
Axia College
IT/244 Intro to IT Security
Instructor's Name: Jennifer McLaughlin
Date: 11/22/2011
1 Authentication
Describe how and why authentication credentials are used to identify and control access to files,
screens, and systems. Include a discussion of the principles of authentication such as passwords,
multifactor authentication, biometrics, and single–sign–on.
Authentication of an individual to access and use files, systems, and screens is vital to ... Show more
Explain who the information owner is that has the responsibility for the information and has the
discretion to dictate access to that information.
Discretionary access control means only certain permitted users are allowed access to specific
things. However, someone with permitted access can let another user use their access. The least
privilege principal is where access is only granted to certain systems and certain data that is needed
to do the users job. Sometimes temporary access is given to data that is required to access random

jobs or to see what that user is doing. When this happens, the access is only temporary, it is
imperative to uphold the principal of least privilege to ensure that user does not have access to the
data when the job finished.
2 Mandatory access control
Mandatory access control is a single user, normally the network admin, who is given access to the
users' rights and privileges. They control access policies and are also in control of choosing which
objects and what systems each individual user has access to and what they do not have access to.
The access is made in the form of different levels. Each system and all folders containing
information are put into a specific classification. The user will be in a certain classification that will
only allow them to access data

Access Controls And Access Control Security Essay
As the use of computers, databases, and technology in general, security has grown to be a powerful
tool that has to be used. The threat of outside sources intruding and exploiting crucial information is
a threat that is present on a daily basis. As a part of creating and implementing a security policy, a
user must consider access control. Access Control is a security tool that is used to control who can
use or gain access to the protected technology. Access control security includes two levels; logical
and physical. Though database intrusions can happen at any moment, access control provides
another security barrier that is needed. Access control has been in use before the growth of the
technology world. It could involve a simple action as locking a door. A person locks a door to
prevent entry to those who are not allowed or authorize to do so. The same can be said about the
security involving databases and the controlling of who can have access and what can be accessed.
As far as database security is concerned, there are various categories that are involved in access
control. The four main categories of access control include: Discretionary, Mandatory, Role–based,
and Rule–based access control. According to Rouse (2006), "Computer databases typically contain
aggregations of data records or files, such as sales transactions, product catalogs and inventories,
and customer profiles" (Rouse, 2006). Databases can hold a sufficient of information that are
deemed valuable by

Definition Of The Simple Substitution Figure
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z will be replaced by down charcters
respectively. like A–R, B–Z as follows.
R Z B U Q K F C P Y E V L S N G W O X D J I A H T M. To encode some content, just locate
every character in the content in the first line, and supplant it by the character underneath it. For
instance, utilizing the illustration above, on the off chance that you encode the word ``BIRDBRAIN
' ', you get ``ZPOUZORPS ' '. To disentangle, reverse the procedure –for the first character in
``ZPOUZORPS ' ', discover ``Z ' ' in the lower line, look above it to get ``B ' '– –the first letter of
``BIRDBRAIN ' ', and so forth. The simple substitution figure offers almost no correspondence
security, and it will be ... Show more content on Helpwriting.net ...
This is as opposed to ordinary techniques for access control, which allow or disavow client access
on an inflexible, object–by–item premise. In RBAC, parts can be effectively made, changed, or
stopped as the needs of the undertaking develop, without needing to exclusively redesign the
benefits for each client. Role based access control (RBAC) is the real trick of making standard
levels of access "consents" to the different figuring assets and systems of an association that are
customized to particular representative parts, or employment works as opposed to people. In an
expansive, data escalated association, it is for the most part far simpler and more solid for
framework security administrators to allocate another contract to one or more "parts" and have all
the proper authorizations set naturally than to do every physicaly. http://www.nist.gov/itl/csd/rbac–
021511.cfm For examples : Access rights are assembled by part name, and the utilization of assets is
confined to people approved to accept the related part. For examples, inside a hospital framework
the part of specialist can incorporate operations to perform analysis, recommend pharmaceutical,
and request research facility tests; and the part of specialist can be constrained to assembling
unknown clinical data for

Essay on The Most Common Types of Systems Access Controls
The most common types of systems access controls
Access control requires unique user identification, emergency access procedure, automatic log–off,
and encryption and decryption of data. In order to maintain confidentiality, integrity and availability
of data, it is important to control access to the information system. Controls prevent unauthorized
users from accessing the system and/or altering data. They also prevent authorized users from
making unauthorized changes to data. Some common examples are User–based, Role–based and
Context–based access control with the strongest security on Context–based access control.
Controls placed on access are categorized in three ways: preventive, detective, or corrective. The
key to access controls ... Show more content on Helpwriting.net ...
This follows the principle of minimal rights whereby users and computers are configured with the
minimum set of access rights necessary to perform their role."
Inadequately secured wireless communication
"Wireless security isn't just a big issue for control systems, but for all uses, mainly because wireless
is becoming so pervasive," says Staggs. "It's very easy to plug wireless in almost anywhere.
However, you have to be able to find the signals and know if someone has put in a rogue point.
"Before installing wireless, it's important to do a complete assessment to identify the best areas for
wireless use and ensure that leakage out of the plant is minimized. There will be a wireless leakage
when you have transmitters or wireless–enabled workers walking around with tablet PCs or
handheld devices. Those devices may be transmitting in an area outside a plant."
Solution can be separation by segmenting the wireless networks from the rest of the control
network. Additionally, it is strongly advisable to secure wireless access methods to include requiring
authentication and enforcing strict access controls for communications leading from the wireless
network into the rest of the control network.
Three components of a good Information Security Program in a healthcare organization.
NIST defines computer security as "the protection

Advantages And Disadvantages Of Single Sign-On
1. What is Single Sign–On? What are the advantages and disadvantages of it
Single sign–on (SSO) is a property of access control of multiple related, yet independent, software
systems. It is a strategy that allows users to sign on to a computer or network once and have their
identification and authorization credentials allow them into all computers and systems where they
are authorized. Hence, users do not need to enter multiple user IDs or passwords which invariably
reduces human error, which is a major part of system failures
Advantages of Single sign–on
Increased efficiency and productivity – It brings about efficient logon process as users only have to
log on once.
It provides failed logon attempt thresholds and lockouts which protects against an intruder using
brute force to obtain an authentic user ID and password combination.
It can provide for stronger passwords. With only one password to remember, users are generally
willing to use stronger passwords.
When businesses have various partners, implementing authentication and authorization can become
somewhat complicated. With Single sign–on, businesses can centralize authentication management
and grant users instant access to all shared applications.
Disadvantages of Single sign–on
A major disadvantage is that it constitutes a single point of failure. A compromised password lets an
intruder into all areas open to the password owner.
Static passwords provide very limited security. Two–factor authentication or

Role Based Access Control (RBAC)
Role based access control is an ideology through which access to systems is restricted based on
authority given. It is used by organizations with a relatively large number of employees ranging
from five hundred to one thousand and above (Sieunarine & University of Oxford, 2011). This is
implemented through the mandatory access control or through the discretionary access control.
These are the only two ways through which role based access control can be implemented.
Roles are normally created for the varying business roles or functions. Performance of certain
activities is limited to certain job roles or functions. Staff members given the task to undertake such
activities are given user accounts unique to them to undertake these roles (Ferraiolo, Kuhn &
Chandramouli, 2003). This is normally under the discretion of the immediate supervisor through
dialogue with the overall supervisor of a particular division or department.
RBAC is among the simplest and flexible forms of access control. MAC is normally associated or
linked to matters relating to the military and or national security. It conforms or is frequently used in
situations whereby there is one major form of authority leading the rest of the pack. It is based on
the premise of one directional flow in a trellis. MAC focuses on the need of restricting others to
certain forms of information that are considered sensitive and one would need clearance to access
the same. Clearance denotes the

Cloud Computing Is The Delivery Of On Demand Computing...
Cloud computing is the delivery of on–demand computing resources which include everything from
applications to data centers over the Internet on a pay–for–use basis. Cloud computing is the result
of evolution and adoption of existing technologies and paradigms. The goal of cloud computing is to
allow users to take beneﬁt from all of these technologies, without the need for deep knowledge
about or expertise with each one of them. The cloud aims to cut costs, and help the users focus on
their core business instead of being impeded by IT obstacles Cloud computing is so named because
the information being accessed is found in the "clouds", and does not require a user to be in a
specific place to gain access to it. The services are offered from data centers all over the world,
which collectively are referred to as the "cloud." The idea of the "cloud" is to simplify the huge
network connections and computer systems involved in online services. Cloud computing is a
computing model, not a technology. In this model of computing, all the servers, networks,
applications and other elements related to data centers are made available to IT and end users. Cloud
computing is a type of computing that is comparable to grid computing. It relies on sharing
computing resources rather than having local servers or personal devices to handle applications.
Access control is generally a policy or a procedure that allows, denies or restricts access to a system.
It also monitors

Access Control Dbq
The purpose of access control, and the rights and privileges is to give users and objects associated
data and records in the database. Objects are tables, views, rows and columns. The goal of this
design is to manage and secure database and assigning such as user name and password.
Management procedures include reading, insert, update and delete or execute stored procedures. In
fact, some models such as access control in mandatory access control (MAC), Discretionary Access
Control (DAC) and the role of building access control (RBAC). Each one of them has some
qualities. And mandatory access control (MAC) means decisions are made by the central authority,
but they cannot change the access for individual owner of the object and the owner's rights.

Role Based Access Controls
Role Based Access Controls
June 16, 2013
Professor M. Hansen
In order to establish system design controls that are directly related to the data input mechanism of a
network and in order to control data entry operations and prevent unauthorized access to information
or data; Role Based Access Controls (RBAC) are required. The basic principle of these controls is
that the data entry personnel, on any level, should be allowed limited access to only specific
information in order to get their jobs done. Because of higher data requirements, more data access
streams, higher employee turnover and outsourcing of data–entry processes there are many avenues
where data can acquired illegally from an outside source and within the organization ... Show more
In many applications, RBAC is concerned more with access to functions and information than
strictly with access to information. (Gupta, 2004)
The Common Criteria also note the following: "security policies defined for systems ... used to
process classified or other sensitive information must include provisions for the enforcement of
discretionary access control rules. That is, they must include a consistent set of rules for controlling
and limiting access based on identified individuals who have been determined to have a need–to–
know for the information." (Kim, 2012) The date input control is another challenge, When you have
several people entering data in your database, you can define how users must enter data in specific
fields to help maintain consistency and to make your database easier to manage. Role based input
control provides data input control. Free text input control, though unavoidable in forms that need
information from the user; should avoid using text boxes and text areas as much as possible. It can
be difficult for the user to enter content into free text input controls such as text boxes and text areas.
Instead, rely on radio buttons, select boxes, and even lists of links. Check boxes are a commonly
used input control; a check box is a small square box that allows the user to select an item or to
deselect it. The user makes this decision by clicking in the small square box. The control is normally
configured with the square box being white

Review Of Using Constructionism Learning Theory
By using constructionism learning theory, the classes of the data system for JCTS can be divided
into four categories:
Non–human resource (Learning resources): many n–part relationships are identified in the EF
(Entity Framework) database. o Learning Objects metadata: Job Techniques. One Technique is one
job competency, which is the objective of learning. o Learning Activities: These Activities can be
learning activities identified for achieving a particular job Technique during a job form creation, and
also the instructional activities applied by the trainee in the job form submitted.
Human Resource: identification and authorization for each user. o Available source for each learner
o Available source for each lead engineer
o ... Show more content on Helpwriting.net ...
Windows authentications are assigned to the users' account which makes the system more secure.
Role Based Access Control (RBAC) is used to control the access of data by different roles of users.
For example: an engineer cannot edit a particular job Technique after logging into the system,
although an administrator has the ability to CRUD (create, read, update and delete) any job
Technique in the system.
Technically, JCTS is based on B/S structure and programmed by ASP.NET technology. All kinds of
database access are done by using EF to call SQL Server stored procedures with ADO.NET
technology. The user web interface is developed by razor html page style and colour scheme is
controlled by Bootstrap. Web interaction is programmed by jQuery. The system operation is stable
and reliable, basically achieved all design features.
3.3 Implementation
The web–based job competency tracking application JCTS is built on 3–Tier arch by using
ASP.NET MVC, jQuery, Bootstrap, C#.NET, Entity Framework and Microsoft SQL Server. Because
of the limitation of length, we presents only one activity diagram for the class "Activity" as an
example to show how MVC is implemented in the code source of JCTS. Figure 13 – Activity
Diagram for the class Activity in JCTS
(Green: view pages; Orange: controller; Yellow: model)
In conclusion, the proposed system JCTS is a web app where an engineer can submit her/his job
form for a specific job Technique. Lead

Security Information Security Plan
Because of the increasing of Cyber–attacks in these days, companies should apply and develop the
information security plan. Not only the large companies but also small companies should think
about the security before facing a lot of issues such as losing data or crashing the system. This paper
will advise some security planning and techniques to assist Voit Tool & Die company strengthen and
improve their security protection plan. 1. Introduction: Security data and information is very
important for any company in the world. Indeed, high technology environment, and organizations
become more and more subordinate on their information systems. The public worry about the
appropriate use of information, specifically personal data. Cybercrime are increasing rapidly. Many
organizations have operations that need to be protected. According to Merriam–Webster Dictionary,
security in general is the quality or state of being secure. Many companies try to secure their
systems and they spend a lot of money for the security. As the result, most company try to define
what they needed. Each security has rules and principle which connect with the protection of the
system. The rules of the security will assist company to decrease the level of the risk. Many
company need to protect their data, system, and hardware. In these days, many companies use a
strong system and update the system each year to secure valuable data. security is to integrate
systems, operations, and internal controls to

Access Controls And Access Control Security Essay
INTRODUCTION
As the use of computers, databases, and technology in general, security has grown to be a powerful
tool that has to be used. The threat of outside sources intruding and exploiting crucial information is
a threat that is present on a daily basis. As a part of creating and implementing a security policy, a
user must consider access control. Access Control is a security tool that is used to control who can
use or gain access to the protected technology. Access control security includes two levels; logical
and physical. Though database intrusions can happen at any moment, access control provides
another security barrier that is needed. Access control has been in use before the growth of the
technology world. It could involve a simple action as locking a door. A person locks a door to
prevent entry to those who are not allowed or authorize to do so. The same can be said about the
security involving databases and the controlling of who can have access and what can be accessed.
As far as database security is concerned, there are various categories that are involved in access
control. The four main categories of access control include: Discretionary, Mandatory, Role–based,
and Rule–based access control. According to Rouse (2006), "Computer databases typically contain
aggregations of data records or files, such as sales transactions, product catalogs and inventories,
and customer profiles" (Rouse, 2006). Databases can hold a sufficient of information that are
deemed

Application And Information Stockpiling On The...
Prior, In the creating stage, we used to make applications and information stockpiling on the
neighborhood servers. In the event that neighborhood server or neighborhood framework crashes,
the whole framework, applications and related information crashes consequently. It was turning into
an enormous issue everywhere throughout the world. To defeat this issue, the idea of distributed
computing was brought out vigorously. Be that as it may because of expanding size of clients'
numerous security related issue emerges and after that security issues turned out to be most regular
in the enthusiasm of analysts. Security models, for example, Mandatory Access Control and
Discretionary Access Control have been the methods by which data were secured and get to was
controlled. However, because of the unbend–ability of these models, the fairly new security idea of
Role–Based Access Control (RBAC) was proposed by the National Institute of Standards and
Technology (NIST) which guarantees to end up a more unmistakable security model. Be that as it
may, because of expanding size of clients giving noteworthy security has ended up bottleneck. This
paper portrays access control, idea of RBAC (Role–based Access Control) display, its downside and
finally we finish up to depict proposed research work to lessen security hazard.
Access Control:
Protection, trust and Access Control are some of security idea required to meet in Cloud stage.
Access Control 's part is to control and breaking point the

The Federal Information Security Management Act
VA Cyber Security Profile
Richard David Thomas Caroll
CSIA 412 7982
November 30, 2014
Introduction.
Through the Federal Information Security Management ACT (FISMA) it was made mandatory that
organizations would have to develop standards that would be in compliance with federal regulations
that were put into place. Because of this the Federal Information Processing Standards Publication
(FIPS) 199 and FIPS 200 were put into place in order to establish a set of standards for
organizations so that they could determine what their category would be for their systems (NIST,
2012). In order to enforce the security categories from FIPS–200, the NIST SP 800–53 would be
utilized in order to set in place a security control ... Show more content on Helpwriting.net ...
Within this security profile three controls and two family controls were selected to be enforced in
order to explore the security awareness and the training being done that can be used as counter
measures against any cyber security threats that may pose a problem to the network. The three
controls that are being examined within management, technical, and operational families will be
based on the needs of the VA and how best to implement them.
2. MANAGEMENT CONTROL. Management Controls are used to put procedures and policies into
place that would allow an organization to be able to function in a secure manner from all of its
levels, to include the ground floor to the top floor.
2.1 Selected Control – Security Assessment and Authorization
The security and authorization family controls are focused on the creation and maintenance of a
security plan. Through this it would identify the individuals responsible for information systems and
the development of plans and how to implement them by creating goals to help them in meeting
their overall goal for their security program.
2.1.1 Family Control #1 Security Assessments
2.1.2 Implementation Status: Not Fully Enforced (Wilshusen, 2007)
NIST SP 800–53 Control: requires the VA to create and put into place a plan that will fully gauge a

Using The Cloud For Large Scale Data Storage
Abstract: In cloud computing and services with the rapid developments, there has been a growing
trend to use the cloud for large–scale data storage. This has raised the important security issue of
how to control and prevent unauthorized access to data stored in the cloud. Access control is one of
the most important security mechanisms in cloud computing. By using the Role Based Access
Control and Attribute Based Access Control, security to the data stored in cloud is enhanced through
the fine grained access control policies. Attribute Based and Role Based Encryption techniques are
used as the main encryption primitive. Signature Based authentication is used to improve security.
Fine grained access control is provided with authentication ... Show more content on
Helpwriting.net ...
The cloud aims to cut costs, and help the users focus on their core business instead of being impeded
by IT obstacles Cloud computing is so named because the information being accessed is found in
the "clouds", and does not require a user to be in a specific place to gain access to it. The services
are offered from data centres all over the world, which collectively are referred to as the "cloud."
The idea of the "cloud" is to simplify the huge network connections and computer systems involved
in online services. Cloud computing is a computing model, not a technology. In this model of
computing, all the servers, networks, applications and other elements related to data centres are
made available to IT and end users. Cloud computing is a type of computing that is comparable to
grid computing. It relies on sharing computing resources rather than having local servers or personal
devices to handle applications.
Access control is generally a policy or a procedure that allows, denies or restricts access to a system.
It also monitors and records all attempts made to access a system. Access Control may also identify
users attempting to make an unauthorized access to a system. It is a mechanism which is very much
important for providing security. Various access control models are in use, including the most
common Mandatory Access Control (MAC), Discretionary Access Control (DAC) and Role Based
Access Control (RBAC). All these models are known as identity

It 244 Access Control Policy Appendix F
Associate Level Material Appendix F Access Control Policy Student Name: Patricia Manter
University of Phoenix IT/244 Intro to IT Security Instructor's Name: Kevin Swinson Date: June 24,
2012 Access Control Policy Due in Week Seven: Outline the Access Control Policy. Describe how
access control methodologies work to secure information systems 1 Authentication Describe how
and why authentication credentials are used to identify and control access to files, screens, and
systems. Include a discussion of the principles of authentication such as passwords, multifactor
authentication, biometrics, and single–sign–on. Authentication is a crucial step in setting up and ...
Show more content on Helpwriting.net ...
This can save an administrator from the tedious job of defining permissions per user. Users are
limited to the available resources their role allows. 3 Remote access Describe the policies for remote
user access and authentication via dial–in user services and Virtual Private Networks (VPN) Remote
access must be strictly controlled. Remote access allows authorized users to access network
resources as if they were at the physical location of the company network. These connections may
be made over the phone lines by directly dialing into a remote access server on the network, or they
may be made by virtual private networking (VPN).The VPN server will support Layer 2 Tunneling
Protocol (L2TP) tunneling with Internet Protocol Security (IPSec) encryption. Dial–in remote access
uses modems, servers running the Routing and Remote Access (RRAS) service, and the Point–to–
Point (PPP) protocol to enable remote users to access the network. One of the most important
security considerations is how remote clients will be authenticated. PAP (password authentication
protocol) will be used. Individuals who remotely access the network will do so by using company
issued devices. They are to use the same security considerations they would be subject to at their
on–site workstations. Remote access servers will use encryption methods and be closely monitored.
References Cite all

The Importance Of IT Security
IT security
IT security also know as computer security or cyber security or Infosec, is the process of protecting
a computer system from the different types of theft or different types of damages to the hardware,
software or data stored in that system as well as from the interference or alteration of the services
provided by the system.
CIA triad's core objectives are considered for IT security programs: keeping the confidentiality,
integrity and availability secure of IT system and company data. These objectives protect the
important information or data from unauthorised parties (confidentiality), prevent modification of
data by unauthorised person (integrity) and assurance of accessibility of data by authorised person
on request ... Show more content on Helpwriting.net ...
They are no longer stick to access the business services within organisations. These services are
accessed by the customers, vendors and partners as well. Thus technology landscaping has given
versatility and productive environment to the business. Whilst it is providing advantages to the
organisations but it has some challenges as well related to data accessibility by unauthorised person
(Cowley, n.d.).
Access control is the method of identifying a person on the basis of his/her job roles and then
authenticates them on as per their identifications and after authentication giving them authority to
access the system. In an organisation, as per the information security system employees are granted
access as per their job roles and responsibilities and username and password are given to each
employee with different rights of system accessibility (read, write or edit) to do their jobs.
So, how these rights of system accessibility are given to the individual as per their job duties and
designation? This is where we used an access control model.
Access control models have four types:
Mandatory Access Control (MAC)
Discretionary Access Control (DAC)
Rule Based Access Control (RBAC or RB–RBAC).
In the Mandatory Access Control, or MAC model, the access control is given to only the owner and
custodian management. End user can not make any

Is4560
Asymmetric Encryption Encryption that uses two keys: if you encrypt with one you may decrypt
with the other MD5 Message Digest 5. A hashing funciton used to provide integrity. MD5 uses 128
bits. A hash is simply a number created by applying the algorithm to a file or message at different
times. The hashes are compared to each other to verify that integrity has been maintained. IPSec 1)
Set of protocols developed to support the secure exchange of packets IPv4 and IPv6 2) Operates at a
low level in the OSI model (Layer 3) 3) Transparent security protocol for applications, users, and
software OSI Model 7.Application 6.Presentation 5.Session 4.Transport 3.Network 2.Data
1.Physical OSI Model Layer 3–Network Handles ... Show more content on Helpwriting.net ...
Dsniff is highly effective for sniffing both switched and shared networks. It uses the arpredirect and
macof tools for switching across switched networks. It can also be used to capture authentication
information for FTP, telnet, SMTP, HTTP, POP, NNTP, IMAP, etc. Netstat Netstat shows IP–related
statistics including: * Current connections * Incoming and outgoing connections * Active selections,
ports, and sockets * The local routing table Netstat is used to view protocol connections that have
been established by the system, as well as what incoming TCP/IP ports are in use by the system.
Scareware / Adware Adware: software specifically designed to display ads in the form of popups or
nag screens Scareware: malware designed to trick victims into purchasing and downloading useless
and potentially dangerous software worm a type of virus that spreads itself, not only from file to file,
but also from computer to computer. the primary difference between a virus and a worm is that a
virus must attach to something. such as an executable file, in order to spread. worms do not need to
attach to anything to spread and can tunnel themselves into computers. Virus Code that attaches
itself to a program that is designed to cause malfunctioning of a computer or damage the data stored
on the computer. bluejacking sending unsolicited messages to another device using Bluetooth to get
the recipient to open

Audit Controls Paper

More Related Content

Similar to Audit Controls Paper

More from Jennifer Lopez

Recently uploaded

Audit Controls Paper