Fundamentals of Information Systems Security, 4th Edition

Authorization Policies

The first step toward controlling access is to create a policy that defines authorization rules. Authorization is the process of deciding who has access to which computer and network resources. In most organizations, authorization is based on job roles, background screening, and any government requirements. These conditions or policies are decided primarily by either a group membership policy or an authority-level policy.

The most detailed authorization policy is based on individual users. In this type of policy, each user has specific assigned privileges, which allow administrators to define approved resource access at a very detailed level. However, maintaining a user-based authentication approach is very difficult because ...