The following is your prototype working model of an access control analysis table (Please see separate attachment for the access control analysis table).
Clearly, you do not have all the details you’d need to produce “ground truth” access control justifications or tactics for any of the user groups at Fleetwings (a medium-sized aircraft and aviation specialty company that designs and manufactures parts, sub-assemblies, and systems that are used by many different companies). That’s okay. Your boss needs your first good thoughts about how different groups connect to which information assets. She also needs your questions, comments, and other impressions, along with your ideas about which connections or situations should be investigated more deeply—and how soon.
Access Control Analysis Spreadsheet Assignment Help
You’ll need to assume how they accomplish their tasks and the information assets required for their roles. That means creating a list of users (as groups and subgroups), a list of information assets, and thinking through the connections.
Take a closer look at the following on the provided spreadsheet (see separate access control analysis spreadsheet table):
- The first three (3) columns capture user group profiles—who they are, what their general purpose is, and where they work.
- The following five (5) columns are about the information asset(s) and the functions or actions that the users take when using these assets.
- The last three (3) columns capture ideas and concerns about access control.
You can leave the two (2) examples there as thought joggers.
It’s time to pick some users and information assets and get started!
- You will need to identify at least five (5) different information asset user groups and put this into the first column of your analysis table spreadsheet.
- At least two (2) of these must be internal user groups (staffed by Fleetwings employees) such as sales, finance, warehouse operations, manufacturing operations, engineering, market research, customer support, marketing, or any others you think need a closer look right now.
- At least two (2) other groups should then be external users, such as customers, vendors, strategic partner organizations, casual, curious visitors to the company’s website, and others.
- Location, location, location: Remember, Fleetwings has locations in multiple countries, as well as customers, suppliers, and regulatory agencies it has to answer to. As you identify and analyze various user groups and subgroups, be sure to stress your analysis by choosing new and different settings—different parts of the company, different geographical settings, and so on. That way, you avoid inadvertently solving only one access control case.
- Analyze those five (5) user groups by working your way across the table.
- As you do this, you may need to narrow your scope, such as focusing on a particular job function or a small set of closely related job functions rather than trying to look at every job and task that the user group may need to perform in the course of doing business.
- Then, continue to fill in those rows by identifying the data assets [one (1) or more] that those users need for the particular job function you specified.
- Example: Note that the Supply Chain Managers row doesn’t show anything about email. Yet, it’s almost a foregone conclusion that they will also use company-provided email systems in their official capacity. So, if you’re going to work this example to completion, you might include email as yet another asset and system that needs its access control requirements identified.)
Document your assumptions, ask questions, and make notes about ideas and possible connections as you work through this analysis and synthesis task. Tell the story behind a user, a task, or what you see as a special security consideration that’s needed. You can do this in Notes and Comments attached to a cell or by adding more blank rows and columns to help you see the questions (or working answers to them that you’ve come up with) in context with your ongoing work. Doing this transforms your “fill in the blanks” into an engaging collaboration place.