Information Systems Security Using Access Controls (Essay Sample)

Name
Instructor
Course
Date
Information Systems Security Using Access Controls.
System's security policy expresses fundamental choices made by the institution for its data security. They define the principle on which access is granted, and what the programs executed on behalf of a user are allowed to do. A security access system can be defined using two parts that cooperate with each other: strategy of security access that describes all the environments and specifications of an entire organization on the security level and access model.
While secure communication is usually necessary for security in computer systems, it is seldom sufficient. Computer systems often rely on access control for security. For instance, access control plays a role in enforcing run-time security specifications in such systems. Unfortunately, while secure communication is relatively well understood, several aspects of security in such systems is an important and challenging research problem. The fundamental idea behind access control is that obtaining a secure object should require some privileges that can be checked at run time.
Discretionary Access Control is based on information ownership and rights delegation. (Department of Defense, 1985). In DAC model, the creator of the information is also considered the owner and administrator of the information. More specifically, the creator is responsible for granting or revoking access to their information. This also means that the creator can give administrative access to other users so that they may grant or revoke access to the information as well.
Compared to other access control model categories, DAC is considered to the most simple (Lopez et al., 2008). Because of its simplicity many security conditions are not taken into account with DAC. For example since users responsible for granting and revoking access, any security requirements are also the responsibility of the users and cannot be easily managed by organizing authorities (Lopez et al., 2008). Another condition unaccounted for is the possibility of cascading revocation chains, where one user removes access from someone immediately after the access, has been granted by different user. Most fundamentally, is the lack of control over the flow of information in DAC. Access can be granted whenever and to whomever at the discretion of the user.
According to a recent report published by the New York Times, hackers recently stole almost $1 Billion from more than 100 banks 30 nations. ...