Authentication, Authorization and Access Control
On your computer monitor, you read the meeting topic: “HR Data Access.” You think, “This might be a tricky one.”
You remember a discussion with John, the CTO, about conflict caused by the sharing of information between two departments. Grabbing your laptop, you head to the meeting.
In the conference room, John is already waiting. He says, “We will be joined by the VP of HR and the managers of the Payroll and Training departments. Our focus will be on access to data that is housed in the HR database.”
The door opens and the other three attendees walk in.
Amy Jones, the vice president of HR, begins: “The database that we use contains all employee data, ranging from payroll and benefits information to training and performance results. The issue that we are facing, and that I hope you can help us alleviate, is that all departments within Human Resources have full access to all of the data within the database.
“Recently, it was brought to my attention that the training department has access to payroll data.”
The two managers glance at one another.
John says, “I believe we can come up with a solution. As a matter of fact, this could be an opportunity to also evaluate the risk level that the HR database has from outside threats.”
John turns to you: “I would like you to prepare a presentation for HR management.
“In this presentation, you will suggest how we might limit access to specific types of data and protect vulnerable data from outside threats. Since we will be presenting to non-technical managers, you will need to explain the difference between authentication, authorization, and access control in plain language. The presentation will be scheduled in three weeks.”
After the meeting, you realize that while you might understand the problems of data access, other employees may not be aware of the issues involving information access in an organization. Your presentation will have to be understood by employees who do not have an information technology background.
