Task:

Organizations have two concerns surrounding access to data: They must limit access to data from outside the organization as well as control which people have access to what data within the organization. In this project, you will explain to management the difference between authentication, authorization, and access control and suggest how to keep outsiders from getting in and keep insiders from getting data they shouldn’t. During this project, you will research the various models for authentication, authorization, and access control. You will also be able to communicate the recommended solution to a nontechnical audience. This is the second of four sequential projects. There are 12 steps in this project. Begin by reviewing the project scenario, then proceed to Step 1.

Competencies

Your work will be evaluated using the competencies listed below.

5.3: Support policy decisions with the application of specific cybersecurity technologies and standards.

6.2: Create an information security program and strategy, and maintain alignment of the two.

6.3: Integrate the human aspect of cybersecurity into an organization’s cybersecurity policy.

9.3: Assess policies, processes, and technologies that are used to create a balanced approach to identifying and assessing risks and to manage mitigation strategies that achieve the security needed.

Step 1: Explore the Basics of Authentication

In order to build a presentation with the most current information available, you will gather information by reaching out to a group of your peers working in various industries. In the next three steps, you will prepare background information for this discussion. You’ll need to have a basic understanding of authentication. Define authentication and identify the core principles and key tenets of authentication as listed below. (Review Computer Networks, Network Devices & Cables and Network Protocols if you do not already have a working understanding of these topics.)

· Identify the ways in which someone can be authenticated (e.g., userids, passwords).

· Describe how authentication has evolved over time and identify stressors that have resulted in changes to authentication.

· Identify the different types of authentication (e.g., layered or two-factor), compare and contrast their attributes, and give examples of each.

· Compare and contrast single-factor and multi-factor authentication.

Step 2: Explore the Basics of Authorization

Another topic you’ll need to be prepared to discuss is authorization. Define authorization and differentiate it from authentication (how are they similar, how are they different?). You will use the notes compiled in this step in your upcoming peer discussion. Complete each of the items listed below.

· Define authorization and identify examples of authorization schemes.

· Determine how access policies are used to express authorization rulesets. Identify key principles of access policies.

· Identify the challenges that can arise when policies are used to maintain authorization rules. Identify solutions to mitigate these challenges.

Step 3: Explore the Basics of Access Control

One last topic to prepare for the upcoming discussion is access control: Define access control, then differentiate between access control, authentication, and authorization. You will use the notes compiled in this step in your upcoming peer discussion. You should describe the different access control models and how they are used, including, but not limited to, the list below. (Review Systems Software, Application Software, Software Interaction and Programming if you do not already have a working understanding of these topics.)

· RBAC—Role-Based Access Control

· MAC—Mandatory Access Control

· ABAC—Attribute-Based Access Control

· IBAC—Identity-Based Access Control

Step 4: Social Psychology Report

In Step 3, you explored the basics of access control and common models of implementing it. Your next task in preparing for your discussion with your peers is to consider the impact that human factors, such as ethics, legal issues, and psychology have on cybersecurity. To synthesize your research on these factors, you will write a report on the psychological aspects of cybersecurity. This report will be used to formulate your recommendations in Step 10 and be included as an appendix to your final presentation in Step 12.

In your report, do the following:

· Explore the typical intrusion motives / hacker psychology. Classify the types of hackers and actors and give an example of a potential incident.

· Define a cybersecurity policy as it relates to employees and employment. For example, how would an organization apply a security policy to employees and employment in relation to network-related programming or other cyber-related positions?

· Define the separation of duties policy and give an example.

· Define redundancy and diversity and explain how they relate to cybersecurity access control. Give an example of a policy integrating the concepts of redundancy and diversity to reduce risk.

· Summarize how the implementation of the access control mechanisms mentioned in this section may have a positive or negative consequence on employee productivity.

Step 5: Privacy Awareness Report

Following your report on the impact of social psychology on cybersecurity, you will compose a report on privacy (Privacy – definition) awareness and the implications on cybersecurity policy to further prepare for the discussion with your peers. This report will be used to formulate your recommendations in Step 10 and be included as an appendix to your final presentation in Step 12.

In your report, complete the following:

· Define ECPA and explain how it affects cybersecurity today. Give an example of how it might come into play at your organization today. Suggest how policy at your organization could support ECPA compliance.

· Define FISA and explain how it affects cybersecurity today. Give an example of how it might come into play at your organization today. Suggest how policy at your organization could support FISA compliance.

Identify any other privacy law that may impact your assigned organization. Give a brief summary of what the law does, how it impacts your organization, and how policy could support compliance.