Exercise: Procedure Guide on Access Controls

Assignment

In a previous assignment for this course, you examined several access controls and how making changes can impact users access to objects. Changing access controls can have some undesirable effects. Therefore, it is important to carefully consider the changes before making them and provide mechanisms to reverse the changes, if they have unexpected consequences. In this assignment, you will develop a basic procedures guide for the Ken 7 Windows Limited security personnel to change access controls as needed.

The purpose of these procedures is not to do busy work, but to ensure that:

You understand and document the purpose of each access control change request.

You know what access controls were in place before any changes are made.

You receive an approval of the change from the Ken 7 Windows personnel.

You understand the scope of the change, with respect to users, computers, and objects.

You have evaluated the expected impact of the change.

You know how to evaluate whether the change meets the goals.

You understand how to undo any change if necessary.

The procedure guide must contain the steps any Ken 7 Windows Limited personnel should take to evaluate and implement an access control change. You can assume any change requests you receive are approved. Ensure that your procedures, and the documentation procedures created for each change include the following:

Status or setting prior to any change

Reason for the change

Change to implement

Scope of the change

Impact of the change

Status or setting after the change

Process to evaluate the change

You should create a step-by-step form for the security personnel that they can use as a procedures guide to understand, explain, and implement an access control change. Your procedures document should explain the need for following these procedures and the benefits to Ken 7 Windows Limited. You should also instruct personnel what to do with the forms after completing them and how they will be stored. You will also need to include a short discussion on how to retrieve forms if you need to undo a change.