The final step in identity and access management systems is
the authorization and accounting processes.
Authorization refers to the rights, the privileges,
the permissions that we grant an authorized user.
It's granted to an entity that has been authenticated so we know
that that person should be allowed on the system.
Now, what can they do once they are on the system?
This is where we often use the term granularity.
What level of access permissions will we give them?
Will it be to read only, to write and modify data,
to update data, execute a program or a process,
create a new record or delete?
And this is where we use those concepts we looked at earlier of least privilege,
need to know, and separation of duties.
The important thing here is that we don't want
unauthorized activity on the system,
which means that unauthorized users could not make any
modifications and an authorized user should not be able to
make improper modifications.
We also keep a record of everything that was done on the system.
This is usually known as accounting, but sometimes called auditing as well.
It's the tracking and logging of all of the activity on the system.
And this is why we wanted unique user IDs,
so we're able to associate all activity with an identified user,
individual, or process.
We should keep these logs so we can review them to see are
people trying to get access they shouldn't?
Are people accessing something that we would prefer they didn't have access to?
This can be important from a regulatory perspective to prove to some type of,
say,
government agency that is looking into privacy laws whether or not
we are compliant with good practices of protecting information from
those who do not have a need to know.
We should always base this level of access we grant on what is
required in order to execute their job or business needs.
In summary, in this module, we set out the concepts of access controls.
That means that all authorized users should be identified,
then authenticated, authorized, and, of course,
subject to logging of all actions taken.