-: In this lesson, we're going to talk about
some of the best practices for access control.
There's several of them out there
that I want you to remember
and think about as you're setting up
your access control systems.
The first one is known as implicit deny.
All access to a resource should be denied by default
and only allowed when it's explicitly stated.
So, for instance, when I create a new folder,
by default, I want it to not allow people to have access,
and then I would go ahead and give access
to the people that need access to it.
This gives you a higher security environment.
Now, by default,
a lot of systems are actually done the other way.
They're done where it's an explicit deny.
Everything is allowed until you deny it.
If you want to have a secure system, though,
you want to configure it as implicit deny.
You want to deny, deny, deny,
and only allow people in that you want to have in.
The next one we want to think about
is least privilege.
Users are only given the lowest level of access
they need to perform their job functions.
This kind of goes back to,
do I want them to be a user, a power user, or an admin?
Well, if they don't need all the functions of an admin,
then don't make them an admin,
make them a power user.
If they don't need the power user,
then make them a regular user
and take away as much permissions as you can
to give people the least they need.
This is going to make sure that people
have what they need to do their job, but not anything more.
For example, let's say that
somebody works in sales or marketing.
Do they need to have access to employee salary data?
Well, no, but if someone works in accounting or HR,
they need that information.
The accountants need it so they can pay the bills,
the HR guys need it so they can figure out
when you need a raise, right?
So, you need to make sure you segment people out
and give them the least amount of permission possible
so that these things don't creep on you.
Also, when you start thinking about this,
you got to think about all the different personal data
that exists on your network, right?
So, as an HR person,
you have access to tons of personal information.
People's social security numbers,
their dates of birth,
their home address, their phone numbers,
all of that stuff.
But as an IT guy, I don't need to know that stuff,
and so, I should be kept out of that area
because I don't need the personal data.
Again, this is the whole idea of keeping those permissions
as low as possible,
so that people don't creep around,
and get information they don't need.
The next best practice is
maintaining a separation of duties.
This means that you're going to require more than one person
to conduct a sensitive task or operation.
So, I'll give you a great example of this
from the corporate world.
If you look in the corporate world,
they have lots of money in their checking accounts, right?
Well, who's going to be able to sign the checks
for a corporation,
and does it only require one person or two?
Let's say that they were going to write a check for $10,000,
that should probably have two signatures
so that no one employee can write themselves a check
for $10,000 and steal it.
So, by having two-person integrity here,
by doing this separation of duties,
where you have a sign and a counter-sign,
you prevent fraud.
Well, we do the same thing in technology.
For example, you might set up your system
that any time someone wants to download more that 5GB
from your share drive,
they need two administrators
to sign off on that using digital credentials.
That can help you prevent data loss, right?
We don't want somebody downloading our entire shared drive
and running off with all of our data.
That's the idea of separation of duties,
it's making sure that it takes more than one person
to do some kind of critical operation.
Now, the other thing with separation of duties
is you can also implement this using a single user,
by having someone who has an admin and a user account.
Now, for example, I work on a daily basis
on my user account, which is called Jason,
but if I need to install a program,
I can't do that from Jason's account.
Instead, I have to log out,
log in as an administrator,
and then install the program.
Why do I do that to myself?
Why do I make my life hard?
Well, because it prevents malware from spreading
if an infection occurs.
If Jason, as a user, is surfing the Internet
and downloads a piece of malware,
it can only run as Jason, as the user,
and not as the admin.
So, by forcing me to log out
and then install something using admin permissions,
that's going to prevent spreads,
and it is a form of separation of duties.
Now, in Windows, this type of separation of duties
can be done automatically using the UAC,
or User Account Controls.
We're going to talk about that later in its own lesson
at the end of this section.
Now, the last best practice I want to talk about here
is called job rotation.
This occurs where users are cycled through various jobs
to learn the overall operations better,
it reduces their boredom, it enhances their skill level,
and most importantly, it actually increases our security.
Now, how does all this happen?
Well, job rotation helps the employee
become more well-rounded and learn new skills.
Let's say I took somebody who is in the sales department
and now, move over to the marketing department.
And then, maybe I move them from marketing
and they go into HR,
and we just keep moving people throughout the company
as they progress upwards and across the organization.
They're learning new skills everywhere they go
and bringing that organizational knowledge with them.
This is great for the company,
but also it's great for security
because job rotation helps us to identify
theft, fraud, and abuse within the organization.
How does it does that?
Well, let's say that you were in IT,
and I moved you from IT
and put you someplace else for two weeks.
While you're gone,
somebody else is having to do your job.
If you were stealing information
or weren't doing your job properly,
that person's going to be able to figure that out.
That's the whole idea with job rotation,
is it forces additional security
and checks and balances into the system.
Another variation of job rotation
is known as mandatory vacation.
Now, mandatory vacation means I require all of my employees
to take two weeks of vacation every year, right?
Now, most of the companies do this
because they want you to have a good time,
and they want you to have some time off and relax,
and recharge, and go to the beach,
and all of that kind of good stuff.
And I want that too, right?
But from a security standpoint,
by forcing those vacations, that means somebody else
has to come in and cover for your job,
and when they're covering for your job,
they may find the things you've been doing wrong,
and doing all those things that are theft to the company,
fraud, and all those other issues.
That's the idea, and so large corporations
have really embraced this idea of mandatory vacations,
because it allows them to uncover things
that they wouldn't have uncovered, otherwise.