NWPU Access control Policy and Procedures in Government AgencyPPT Requirements for the research paper include… • Must be written in APA format and shoul

NWPU Access control Policy and Procedures in Government AgencyPPT Requirements for the research paper include…

• Must be written in APA format and should be 10-12 pages long.

• Contain at least 3-5 works cited (references)

• At least 2 of the works cited should be peer-reviewed articles (not more than 5 years old)

• No Wikipedia citations

Possible points: 250

Requirements for the presentations:

• Minimum of 10 slides

• Every team member must participate in the presentation

• Contain at least 3-5 works cited (references)

• At least 2 of the works cited should be peer-reviewed articles (not more than 5 years old)

• No Wikipedia citations

Possible points: 150 Practical Connection Team Research Paper
Figure 1: Google research images for Government Organizations
About the topic:
As the Government bodies are the main cited research institutions, they will work with more
security in order to maintain and secure their data. Access control policies outlines the control
which are there in place for physical access as well as the Software systems. Information security
is the preliminary concern for any government instituition. In order to limit access to computer
networks and data, access control policies are defined.
1
To support these defined policies, there are certain procedures in place, which defines the
methods to implement it. It will come up with Access controls defined per user basis, it will tell what
user can access the data,information and systems at predefined timings and days.It will
authenticate user by presenting user’s credentials.
These government bodies will not operate like any other IT organization and will keep their
environment more restricted and secured.
We will then define certain policies, procedures, predefined management and their responsibilities
to highlight, how a governed body actually works on their security
with certain restrictions in place, which could be more stringent than any other organization while at
work. There are certain policies, which set out the statewide information security standards. Those
standards are defined as per the company norms and are to be followed by every individual users
who is part of security system.
Policies, Procedures and Guidance:
2
Figure 2: Google research images for Government Organizations
Certain generic Policies and Procedures, which are then guided and followed by the Government
organizations are as below:
Any user is an authorized user, who falls under the below policies to gain access to the security
controls of an organization. Any user who does not meet any of the condition or number of
conditions as defined by the company, shall be prohibited from accessing the data. Each user will
be authenticated for a valid account, with unique User Id and Password. Sharing of those accounts
will be marked as security violation, which could then terminate user’s record or take a legal action
against.
It is the responsibility of state and agencies to implement necessary controls for providing
authorized access to all the resources. Assets used in these government organizations are also
managed to ensure only authorized devices have access to the secured site. Every individual is
supposed to provide their identity and authenticate it to avoid any risk because of any criminal
activity.
1)A user will be granted access to government site when the purpose of the site actually meets the
need,like DHS(Department of Homelands security) can be accessed securely if a user is registered
for DHS duties.
2)User account will be deactivated, if account is no longer required or if account of user is
transferred.
3)Intended system usage should meet defined timeline, if timeline is exceeded, user by default will
be logged out of system and authorization will not be granted for couple of days.
4)Any modification or alteration in the security system will be captured and if found violated, there
will be an action against the user who shall do the modifications
3
5)Approvals will be required to establish connections to outside world.
6)Privileged roles like Network administration,database management, web administration will be
monitored for security purpose.
7)Vandalizing of any physical access in place will be actioned.
8)Biometrics or Fingerprint scan will be captured for attendance purpose.
9)Any temporary access which is granted to the user, will be revoked after the defined timeline
10)Multifactor authentication will be implemented for any remote login for security, which will
ensure right user access.
To follow the policies, certain defined procedures which will authorize, authenticate, Manage and
Audit security level access are required to be in place.
These procedures will approve user to access the data. Like for a cloud based access control
procedure, specific level of access is provided and stored in the cloud with the administrator, this
authorization can also be changed through cloud based administrator.
User must comply with the procedures, when accessing the system. Different authentication
methods can be kept in place to grant access to the user to security checks, it could be a physical
security check or an access to the software. Government unit, to enhance the security can change
these procedures anytime or they do it time to time to remain compliant.
Purpose to Adhere the policies:
4
Figure 3: Google research images for Government Organizations
Access control policies are defined to minimize the risk of any unauthorized access. These
governed bodies will have the customer data, which is to be kept secured.
Every information shared by the customer to the government is confidential to the user and cannot
be shared across. Purpose to adhere these policies involves:[1]
1)Need to protect Government data and other assets
2)Government agencies works with large infrastructure to maintain each and every individual data,
to reduce the risk to business they need to follow these policies and procedures.
3)In case, there is a threat – it will help to recover from any loss
4)It will help in tracking any unauthorized personnel.
5)To remain compliant, there is a need to demand stringent policies to be defined.
Predefined Management: There are certain predefined rules and tasks maintained by
management, which will enforce time to time check of all the user accounts which includes:
1)Identification of all the account types, whether it is an individual user, group user or any
anonymous guest.
5
2)It will update access roles in a timely fashion, based on level of access required for specific user
to do the job.
3)Establish,remove, deactivate, disable or modification of user groups
4)Reviewing accounts
5)It will have track of all the user activities, which will also make sure that user will logout of the
security system after defined interval.
6)Audit logs will maintain the security check by monitoring daily tasks
7)Reports any unauthorized activity to organization officials.
8)It will make sure to track all the role assignments.
9)Well documented approved process should be in place to create all the user accounts.
10)Not everything is managed by one person but account managers are assigned for every project
11)There should be backup system administrator for all the roles, in case of primary is not present
due to any reason.
12)Before system moves to production, all the special privileges accounts like super user or root
shall be disabled.
13)All the user ID’s should be deleted upon termination of an employee
14)All systems should have assigned authorized personnel for its access.
15)Access control rights, like read, write and execute shall be granted as per need of the user or
group
These predefined tasks ensures security check on all the activities happening everyday, which is
the most primarily need of any government organization. Basis on what type of data governed
6
organization keeps a track on, these predefined management tasks can play an update role. It is a
need of time to adhere with all the company norms for any individual user and keep an update on
daily tasks.
Information security based on Access control Policies:
Access control policies are employed by organizations to control access between users and
devices or files. Consideration is given to auditing ,It will explicitly override policies in event of any
emergency. In case of any data transmission to any unauthorized unit, encryption will be followed
with stringent norms. Multiple Access control policies will have a role in place:[2]
1)Mandatory Access control : This type of Access control will make sure, each user will receive
only that information to which user is authorized. It will classify all end users and provide them with
labels which permit them to gain access through security with established security guidelines.
2)Role based access control : Role based access control is defined by the job responsibilities, in
place of assigning someone a predefined role,person already holding up that same role has access
control permissions. In case role is changed, change of role will provide same level of assurance in
the change of access authorization for both user and process.
3)Discretionary Access Control : This type of access control gives all the rights to business owner,
which will decide roles for all the users, whether they are allowed in a specific location or not.It is
not restricted as much as Mandatory access control and role based access control is.
7
Figure 4: Source:GAO analysis
Information flow control:
With all the defined rules and set of policies,it is important to decide where and how the information
should travel. Governement agency will always hold data, which is to be kept secured in case there
is a need of transmission with the outside world. Information flow control will always decide where
8
the information is allowed to travel within an information system and between information
systems,it will oppose who is allowed to access the information but restrict the places for it to pass.
It will block outside traffic through means of proxies or firewall,which will block any web request
which is not supposed to pass through. It will only send information through designated source and
destination. Information system will also provide capability for privileged administrator to
enable/disable security filters.
Information flow control will not let any unwanted data to come across the government secured
systems,which will protect it from any hacking to disturb its liabilities.
Responsibilities:
The organization trains personnel in their contingency roles and responsibilities with respect to the
information system and provides training with a timely approach to ensure everyone to be on same
page with the secured policies. Government organization identifies information systems containing
software affected by any software flaw and reports this to designation security
personnel.Organization will install all the software updates to keep all the security systems
updated,which includes patches or any hot fixes.An flaw during the update or error handling will
also be reported to the security designated personnels.These organizations will also be using CVE
– which is Common vulnerability exposure in remediating flaws to the system.Methodology to carry
out the updates,will also be in direct contact with the units posting the updates.Certain Government
organizations will apply these updates via automated medium,which will have defined timelines for
any update to the security systems.
Any malicious user,who will try to write the code to debug security data will be terminated and
incident will be reported to the authority.No outside removable media is allowed to information
security system.Any information attack will be detected.Security will be enhanced or will be made
9
more stringent which will request every authorized user to update the records and follow new
norms. Access control change for any security personnel is an Important thing to know,before they
continue with the work or showcase change management for any approvals.
Role
Definition
Agency
The Agency Head, the Chief Information Officer (CIO), the Chief
Management
Information Security Officer (CISO), or other designated organizational
officials at the senior leadership level are assigned the responsibility for
ensuring that the goals and requirements of the Access Control Policy are
met. Responsible for ensuring that the approved administrative and
technical privacy controls are in place and effective. Responsible for
educating employees about their access control responsibilities.
Information
The Information Security function is responsible for the protection of
security
information and information systems from unauthorized access, use,
disclosure, disruption, modification, or destruction in order to provide
confidentiality, integrity, and availability
Covered personnel
Covered personnel are required to understand their security
responsibilities and have the requisite skills and knowledge to ensure the
effective execution of the roles they are assigned to reduce the risk of
unauthorized access, use or modification of IT Resources (theft, fraud or
misuse of facilities).
Disciplinary actions for Non- Compliance:
10
Figure 5: Google research images for Government Organizations
The organization reviews and updates a formal, documented access control policy that addresses
roles, responsibilities and compliance.This control is intended to produce the policy and procedures
that are required for the effective implementation of selected security controls.Any violation of rule
will raise disciplinary action against the user.There are actions defined by these government units
in place for any breach in the norms like:
1)User if unauthorized, will be terminated from the system
2)Audits can lead to account deletion,modifications.
3)Unauthorized personnel’s record could be terminated from any job in future.
4)No other regulatory unit will accept the employment
Reference:
[1] Kisi,Retrieved from: https://www.getkisi.com/guides/access-control-policy
[2] Davis,Shannon.2018:Retrieved from:https://www.tedsystems.com/3-types-access-control-which-right-building/
11
[3] SCIO-SEC-301-00.2018.Retrieved from:
https://files.nc.gov/ncdit/documents/Statewide_Policies/SCIO_Access_Control.pdf
12

Purchase answer to see full
attachment