{"id":3243,"date":"2014-09-18T14:24:50","date_gmt":"2014-09-18T19:24:50","guid":{"rendered":"http:\/\/www.carnaghan.com\/?p=3243"},"modified":"2019-07-22T17:25:38","modified_gmt":"2019-07-22T22:25:38","slug":"managing-access-to-information-resources","status":"publish","type":"post","link":"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/","title":{"rendered":"Managing Access to Information Resources"},"content":{"rendered":"<p>Security breaches caused by internal employees, consultants, business partners and any other individual or group of individuals that have privileged access to certain parts of the network remain one of the highest threats to digital assets.&nbsp; In an article about the employee life cycle and identification of internal organizational threats, Conrad et al (2009) asserts that within an organization, the employee population is the source of potential malicious insiders.&nbsp; <!--more-->According to Posy et al. (2012), 88% of all data breaches were caused by an employee of the company.&nbsp; In addition to this, because of their ability to use their knowledge to exploit a weakness, and motivation to do the business harm, the disgruntled employee can be one of the most severe threats. Not all employees are out to cause malicious harm.&nbsp; Internal security breaches can be either deliberate or non-deliberate due to negligence and \/ or lack of training or security awareness.<\/p>\n<p>So why are internal threats, breaches and destruction of digital assets such a problem?&nbsp; Schnieder (2012) points to the main problem facing many organizations today.&nbsp; On average, employees simply have access and privileges to systems they should be restricted from.&nbsp; To get around this problem several things need to happen, which include, but are not necessarily limited to:<\/p>\n<ul>\n<li>A clear and concise policy needs to be implemented and followed with regard to both internal and external access controls.&nbsp; This policy should outline the process of network membership from hiring of an employee through to termination.&nbsp; It should also include clear rules for external personnel including contractors.<\/li>\n<li>As Schnieder points out, roles based authentication should be at the core of any type of access control or membership system.&nbsp; This will not only make the administrative tasks access control easier, but will also help with auditing. Clear roles and permissions should be defined and updated as needed.<\/li>\n<li>Any sensitive systems carrying personally identifiable information (PII), or secret or confidential data, should not only be located in a secure area of the network, but they should also require additional levels of security access to these roles as applicable.<\/li>\n<\/ul>\n<p>By implementing these suggestions, organizations should have less difficulty managing their users, while strengthening their overall security and access control procedures, better enabling them to effectively manage their information resources.&nbsp; Since the internal actor continues to be a significant threat facing many businesses today, any policies and technology implemented should be continually reviewed and updated as needed.<\/p>\n<p>References:<\/p>\n<p>Conrad, S., H., Dur\u00e1n, F., A., Conrad, G., N., Duggan, D., P., &amp; Held, E., B. (2009). Proceedings for the 2009 Int\u2019l System Dynamics Conference: <i>Modeling the Employee Life Cycle to Address the Insider Threat.<\/i> Retrieved from: <a href=\"http:\/\/www.systemdynamics.org\/conferences\/2009\/proceed\/papers\/P1365.pdf\">http:\/\/www.systemdynamics.org\/conferences\/2009\/proceed\/papers\/P1365.pdf<\/a><\/p>\n<p>Posey, C., Bennett, R., &amp; Robert, T. (2012).&nbsp; Understanding the mindset of the abusive insider: An examination of insiders\u2019 causal reasoning following internal security changes. <i>Computers &amp; Security<\/i>, 30 (2011), 486- 497.<\/p>\n<p>Schnieder, B., &amp; Ranum, M. (2012). <em>Schneier-Ranum Face-Off: Is Perfect Access Control Possible?<\/em> Retrieved from: <a href=\"http:\/\/searchsecurity.techtarget.com\/magazineContent\/Schneier-Ranum-Face-Off-Is-Perfect-Access-Control-Possible\">http:\/\/searchsecurity.techtarget.com\/magazineContent\/Schneier-Ranum-Face-Off-Is-Perfect-Access-Control-Possible<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security breaches caused by internal employees, consultants, business partners and any other individual or group of individuals that have privileged access to certain parts of the network remain one of the highest threats to digital assets.&nbsp; In an article about the employee life cycle and identification of internal organizational threats, Conrad et al (2009) asserts [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[356],"tags":[4234],"post_series":[410],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Managing Access to Information Resources - Ian Carnaghan<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Managing Access to Information Resources - Ian Carnaghan\" \/>\n<meta property=\"og:description\" content=\"Security breaches caused by internal employees, consultants, business partners and any other individual or group of individuals that have privileged access to certain parts of the network remain one of the highest threats to digital assets.&nbsp; In an article about the employee life cycle and identification of internal organizational threats, Conrad et al (2009) asserts [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/\" \/>\n<meta property=\"og:site_name\" content=\"Ian Carnaghan\" \/>\n<meta property=\"article:published_time\" content=\"2014-09-18T19:24:50+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-07-22T22:25:38+00:00\" \/>\n<meta name=\"author\" content=\"Ian Carnaghan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@icarnaghan\" \/>\n<meta name=\"twitter:site\" content=\"@icarnaghan\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ian Carnaghan\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/\"},\"author\":{\"name\":\"Ian Carnaghan\",\"@id\":\"https:\/\/www.carnaghan.com\/#\/schema\/person\/c689c24d516c51968a88b628860740a5\"},\"headline\":\"Managing Access to Information Resources\",\"datePublished\":\"2014-09-18T19:24:50+00:00\",\"dateModified\":\"2019-07-22T22:25:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/\"},\"wordCount\":511,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.carnaghan.com\/#\/schema\/person\/c689c24d516c51968a88b628860740a5\"},\"keywords\":[\"CSEC 630\"],\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/\",\"url\":\"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/\",\"name\":\"Managing Access to Information Resources - Ian Carnaghan\",\"isPartOf\":{\"@id\":\"https:\/\/www.carnaghan.com\/#website\"},\"datePublished\":\"2014-09-18T19:24:50+00:00\",\"dateModified\":\"2019-07-22T22:25:38+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.carnaghan.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Managing Access to Information Resources\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.carnaghan.com\/#website\",\"url\":\"https:\/\/www.carnaghan.com\/\",\"name\":\"Ian Carnaghan\",\"description\":\"Software Developer, Blogger, Educator\",\"publisher\":{\"@id\":\"https:\/\/www.carnaghan.com\/#\/schema\/person\/c689c24d516c51968a88b628860740a5\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.carnaghan.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/www.carnaghan.com\/#\/schema\/person\/c689c24d516c51968a88b628860740a5\",\"name\":\"Ian Carnaghan\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.carnaghan.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f2aa5baca80c2be728de43a975185d91?s=96&d=retro&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f2aa5baca80c2be728de43a975185d91?s=96&d=retro&r=g\",\"caption\":\"Ian Carnaghan\"},\"logo\":{\"@id\":\"https:\/\/www.carnaghan.com\/#\/schema\/person\/image\/\"},\"description\":\"I am a software developer and online educator who likes to keep up with all the latest in technology. I also manage cloud infrastructure, continuous monitoring, DevOps processes, security, and continuous integration and deployment.\",\"sameAs\":[\"http:\/\/www.carnaghan.com\",\"https:\/\/x.com\/icarnaghan\"],\"url\":\"https:\/\/www.carnaghan.com\/author\/icarnaghan\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Managing Access to Information Resources - Ian Carnaghan","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/","og_locale":"en_US","og_type":"article","og_title":"Managing Access to Information Resources - Ian Carnaghan","og_description":"Security breaches caused by internal employees, consultants, business partners and any other individual or group of individuals that have privileged access to certain parts of the network remain one of the highest threats to digital assets.&nbsp; In an article about the employee life cycle and identification of internal organizational threats, Conrad et al (2009) asserts [&hellip;]","og_url":"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/","og_site_name":"Ian Carnaghan","article_published_time":"2014-09-18T19:24:50+00:00","article_modified_time":"2019-07-22T22:25:38+00:00","author":"Ian Carnaghan","twitter_card":"summary_large_image","twitter_creator":"@icarnaghan","twitter_site":"@icarnaghan","twitter_misc":{"Written by":"Ian Carnaghan","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/#article","isPartOf":{"@id":"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/"},"author":{"name":"Ian Carnaghan","@id":"https:\/\/www.carnaghan.com\/#\/schema\/person\/c689c24d516c51968a88b628860740a5"},"headline":"Managing Access to Information Resources","datePublished":"2014-09-18T19:24:50+00:00","dateModified":"2019-07-22T22:25:38+00:00","mainEntityOfPage":{"@id":"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/"},"wordCount":511,"commentCount":0,"publisher":{"@id":"https:\/\/www.carnaghan.com\/#\/schema\/person\/c689c24d516c51968a88b628860740a5"},"keywords":["CSEC 630"],"articleSection":["Cybersecurity"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/","url":"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/","name":"Managing Access to Information Resources - Ian Carnaghan","isPartOf":{"@id":"https:\/\/www.carnaghan.com\/#website"},"datePublished":"2014-09-18T19:24:50+00:00","dateModified":"2019-07-22T22:25:38+00:00","breadcrumb":{"@id":"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.carnaghan.com\/managing-access-to-information-resources\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.carnaghan.com\/"},{"@type":"ListItem","position":2,"name":"Managing Access to Information Resources"}]},{"@type":"WebSite","@id":"https:\/\/www.carnaghan.com\/#website","url":"https:\/\/www.carnaghan.com\/","name":"Ian Carnaghan","description":"Software Developer, Blogger, Educator","publisher":{"@id":"https:\/\/www.carnaghan.com\/#\/schema\/person\/c689c24d516c51968a88b628860740a5"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.carnaghan.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.carnaghan.com\/#\/schema\/person\/c689c24d516c51968a88b628860740a5","name":"Ian Carnaghan","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.carnaghan.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/f2aa5baca80c2be728de43a975185d91?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f2aa5baca80c2be728de43a975185d91?s=96&d=retro&r=g","caption":"Ian Carnaghan"},"logo":{"@id":"https:\/\/www.carnaghan.com\/#\/schema\/person\/image\/"},"description":"I am a software developer and online educator who likes to keep up with all the latest in technology. I also manage cloud infrastructure, continuous monitoring, DevOps processes, security, and continuous integration and deployment.","sameAs":["http:\/\/www.carnaghan.com","https:\/\/x.com\/icarnaghan"],"url":"https:\/\/www.carnaghan.com\/author\/icarnaghan\/"}]}},"views":49,"_links":{"self":[{"href":"https:\/\/www.carnaghan.com\/wp-json\/wp\/v2\/posts\/3243"}],"collection":[{"href":"https:\/\/www.carnaghan.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.carnaghan.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.carnaghan.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.carnaghan.com\/wp-json\/wp\/v2\/comments?post=3243"}],"version-history":[{"count":0,"href":"https:\/\/www.carnaghan.com\/wp-json\/wp\/v2\/posts\/3243\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.carnaghan.com\/wp-json\/wp\/v2\/media?parent=3243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.carnaghan.com\/wp-json\/wp\/v2\/categories?post=3243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.carnaghan.com\/wp-json\/wp\/v2\/tags?post=3243"},{"taxonomy":"post_series","embeddable":true,"href":"https:\/\/www.carnaghan.com\/wp-json\/wp\/v2\/post_series?post=3243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}