You are asked to develop the Access Control Policy section of your Information Security Policy. One important aspect to always consider is the budget and don't be surprised if this changes during your process. Below are detailed breakdowns of what you need to include with each section, I hope this helps and feel free to ask any questions.
For this assignment, chapter 4 is a great resource as well as our class discussions.
User enrollment -remember to include your scenario
• What is user enrollment?
• How and why is this used?
Identification -remember to include your scenario
• What is identification?
• How and why identification is used to identify a user?
• Describe advance techniques used to identify a user?
Authentication - remember to include your scenario
• What is authentication?
• How and why authentication credentials are used to identify and control access to files, screens, and systems?
• Include a discussion of the principles of authentication such as passwords, multifactor authentication, biometrics, and single-sign-on.
Privileged and special account access - remember to include your scenario
• How and why privileged and special account access are used?
• Include group-based and user-assigned privileges.
Remote access - remember to include your scenario
• What is remote access?
• Describe the policies for remote user access and authentication via dial-in user services and Virtual Private Networks (VPN)
Access Co
Describe how and why authentication credentials are used to identify and control access to files, screens, and systems. Include a discussion of the principles of authentication such as passwords, multifactor authentication, biometrics, and single-sign-on.
Describe how and why discretionary access control will be used. Include an explanation of how the principle of least privilege applies to assure confidentiality. Explain who the information owner is that has the responsibility for the information and has the discretion to dictate access to that information.
Describe how and why mandatory access control will be used.
Describe how and why role-based access control will be used.
Remote Access
Describe the policies for remote user access and authentication via dial-in user services and Virtual Private Networks (VPN).