Access Control and Identity Management, 3rd Edition

Best Practices for Access Controls for Information Systems

Access controls for information systems are only as good as the policies and procedures that dictate their use. There are a few general best practices that you should follow to ensure reasonably secure access controls on information systems:

• Create a baseline for access—Build a baseline for the current access levels in the environment. This will help identify holes in access and identify which users have rights beyond their needs.
• Segregate users’ rights by their role—Developers do not need access to production databases; sales executives do not need access to the accounts receivable system.
• Automate user creation—Have prebuilt groups for the major roles in the organization so that ...