IS3340-WINDOWS SECURITY | Recommendations for Access Controls | Unit 2 Assignment 1 | | [Type the author name] | 4/3/2014 |

|

Access Control is the defined as “the selective restriction of access to a place or other resource”, in the RFC 4949. “The act of accessing may mean consuming, entering, or using. Permission to access a resource is called authorization.” Simply put the ability to read, write, modify, or deleting information or files is what Access Control is. It is more than this, in the permissions (authorization) granted to each Security Group or Individual User. The permissions mentioned in the previous paragraph are rights that a user is allowed to access, create, modify, or delete the file(s) inside a file folder, or objects. These are all permissions (authorizations) controlled by the Authorized Windows Security Personnel of the file structure. We will list some examples of how this outlined and what the impact would be, but first understand that requirements for the permissions is controlled from the Group Level, other than by Individual User, because it is easier to control from a security standpoint when you want to modify these abilities. There are four folders created (D:\ERPdocuments, D:\ERPdocuments\HRfiles, D:\ERPdocuments\SFfiles, D:\ERPdocuments\MGRfiles) which we want to allow specific permissions for certain functions (tasks). For example; by modifying the permissions under the specific user account for HRmanager to include read/write capabilities, you would allow the ability to modify files inside the D:\DRPdocuments\HRfiles folder for the HRmanager. If you removed HR from the ‘List folder contents’ permission under the D:\ERPdocuments\HRfiles, any individual user in the HR Security Group would not be able to view anything under the HRfiles (D:\ERPdocuments\HRfiles) folder. The last example is if you added Shop Floor to the ‘Modify’ permission for D;\ERPdocuments\HRfiles. Mistakenly all users in the ShopFloor Security Group would be allowed to modify any file inside the D:\ERPdocuments\HRfiles folder.
You would only what to give permissions that are very specific to users that you want to allow certain abilities of files. You can think of this up one level from individual files, to folders as well, but the same principle applies. It cannot be stressed enough that as an Administrator of the file folder structure, only specific individuals or groups need to be granted permission to do certain things. This is why it is extremely important to carefully consider permissions when granting them.

Works Cited
Solomon, Michael. "Access Contols in Microsoft Windows." In Security strategies in Windows platforms and applications. Sudbury, Mass.: Jones & Bartlett Learning, 2011. 40-62.