There is an additional managerial challenge: every part of the organisation relies on
specific computer networks and applications. The management of the specific business
process and its tools needed to support them are accountable for ensuring that the rights of
individuals accessing these systems or “permissions” are consistent with their roles and
responsibilities.
For example, a bank employee working in a provincial branch would have no reason to
access data on clients at other locations. If access is enabled there is a need to define that
define what the person is allowed to do with the data (read only, download, update, create,
delete).
This is an onerous task which when not appropriately managed, may result in people
accumulating access rights (usually referred to as “permissions”) as they move through the
organisation as a result of promotion or reorganisation.
In practice, it is hard to create a detailed and complete list of permissions when one does
not already exist. There are tools supposed to facilitate this process. Newer enterprise systems
include tools to define Role Based Access Controls (RBAC). These controls and any
temporary exceptions to them, , require management attention and regular validation.
đang được dịch, vui lòng đợi..
