Week 3 Course Lesson Plan
IT2580 Introduction to Information Systems Security—Unit 3
Mr. Phillip Parrinelli pparrinelli@itt-tech.edu
619-327-1800

Unit 3: Appropriate Access Controls for Systems, Applications, and Data Access

Learning Objective
Explain the role of access controls in implementing security policy.

Key Concepts
The authorization policies applying access control to systems, application, and data
The role of identification in granting access to information systems
The role of authentication in granting access to information systems
The authentication factor types and the need for two- or three-factor authentication
The pros and cons of the formal models used for access controls

Reading
Kim and Solomon, Chapter 5: Access Controls.

GROUP ACTIVITY

Discuss and complete the following worksheet:

-------------------------------------------------
IT2580: Unit 3 Types of Authentication

Instructions:
In the following table, identify the type of authentication for the given authentication methods.

Authentication Method | Authentication Type
(Knowledge, Ownership, or Characteristic) | Password | | Smart card | | Fingerprint | | Personal identification number (PIN) | | Token | | Badge | | Signature | |

-------------------------------------------------
DISCUSSION
-------------------------------------------------
IT2580: Unit 3 Access Controls

Discussion:

Access controls can be applied in various forms, levels of restriction, and at different places within a computing system. A combination of access controls can provide a system with layered “defense-in-depth” protection.

Instructions:
For the scenarios that follow, identify the data that would need to be protected. Recommend how you would implement one or more of the following controls for the given scenarios and