A basic tenet of security architectures is the layered implementation of securit

Question

A basic tenet of security architectures is the layered implementation of security. To achieve defense in depth, an organization must establish multiple layers of security controls and safeguards, which can be organized into policy, training and education, and technology. The information security architecture is created from sound principles. 33 Design Principles have been developed to incorporate multiple scenarios the Information Security System may encounter.  Go to http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-27ra.pdf to research the NIST Special Publication 800-27 Rev A. Select one of these principles and create a summary of that concept to share with the class. Your summary will define the concept as well as provide examples of how the concept fits into the overall Information Security Architecture. You may address how this concept also builds on other principles.

Explanation / Answer

Principle 33 : Use unique identities to ensure accountability.

Ensuring unique identities to all the user or a program(remote program e.g. web service) which is trying to access a system helps us maintain accountability and tracebility. Unique identities is a important information security discipline that allows user/program access to appropriate technology resources, at the right time. It incorporates three major concepts: identification, authentication and authorization. Together, these three processes combine to ensure that specified users have the access they need to do their jobs, while unauthorized users are kept away from sensitive resources and information. It helps us to enusre data security as only right user will have access to right resources. Managment of user and permission assigned to them becomes quite easier.

For example: In an organization ABC, a new employee join ABC, he will be assigned a unique identity and will be alloted a laptop for doing his/her work. After working for 5 days, he left the organization without informing the company. Because that person has unqiue identity IT Mgmt Team can identify the serial number of laptop that is missing. They will revoke his/her access to network resource/VPN etc. So, having a unqiue identity is must for an organization.

Related Questions

Navigate

• Browse (All)
• Browse A
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.