Question

Access control can be considered as the central element of computer security. Question 4(a), 4(b), 4 (c) and 4(d) based on this information.

4 (a). Relate the principal objective of computer security with the function of access control.

4 (b). Briefly explain how access control being implemented in the machine.

4 (c). If Process A requires 500MB of memory space to perform calculation and Process B requires 100MB of memory space to perform graphics processing, identify the object, subject and access operation in this scenario. Provide explanation for your answer.

4 (d). Company RT wants to have different access levels for each of its users. A management level employee will have more privileges to files and operations. The executive level will have moderate privilege to the files but individual users will have their own level of control to the files they own. Which type of access control is suitable for this company and its employee? Clearly explain and justify your answer.

Answer 1

(a) The main objective of computer security are:confidentiality,integrity,and availability.By implementing confidentiality we can prevent the disclosure of confidential information to the unauthorized users.Integrity refers to the accuracy and consistency of data and systems.Modification of data by unauthorized users have to be prevented here.Availability ensures all the defined service to be available to the authorized users.

Access control is actually the mechanism to minimize the security risk of unauthorized access .It can be physical or logical.Physical access control limits the access to physical entities like rooms,building and other IT assets.But logical access limit the access to system data files,network etc.

By implementing access control we can avoid the unauthorized access and thereby able to achieve the principal objective of computer security.

(b) Physical access we can implement through biometric systems like punching cards,face recognition,eye recognition etc.By providing user rights for databases and applications we can implement logical access control.

(d) Role based Access control is the best method we can adopt here. Here based on individuals or groups we can give the authorization.Here we can seperate the groups into management level employee,executive level employee,users etc.Then based on the role,authorization can be done.