- [Instructor] Now the next step
of an access control process
is to establish the access control policy
for each asset or data.
And this will be based on the classification label
the asset has received,
in classification on marking that we discussed
earlier in this lesson.
Now, the access control policy should include information
on who can access the asset or its data,
and when, and in which modality.
Now, the access control policy will also describe
how that asset should be protected depending on its state.
There are three main states that could be of any given time
or the data, it could be in any given time.
The first one is data at rest.
And that refers to data that resides in a storage device
such as a hard drive, or USB drive,
or pen drive, or any digital media.
Now, data is in this state most of its lifetime.
Data at rest is usually protected
by strong access controls and encryption.
Now, the next one is data in motion.
And that refers to data
that is actually moving between two parties,
and that is in transit.
When the data is in this state, it is subject to higher risk
because it goes outside of the security perimeter
where the data owner may actually have not
provided any control, or doesn't even have any control.
So in that case,
end-to-end encryption and VPN technologies
are actually usually used to protect data in motion.
Now, there's also the concept of data in use,
which refers to data being processed
by applications or programs
that are stored in a temporary or volatile memory
such as a Random Access Memory or RAM,
what we classify as RAM,
CPU registers, and other similar mechanisms.
Now, there are different roles
that are commonly used within an organization.
So it will not be unlikely
to find different names or definitions
for a similar function,
but here are some of the most common ones.
The first one is executives and senior management.
They have the ultimate responsibility
over the security of the data
and the assets within the organization.
They should be involved in all the policies and procedures,
and also they're the ones
that approve access to control policies.
Now, the next one is the data owner.
And the data owner is also called information owner.
And it's usually part of the management team
that maintains ownership and responsibility
over a specific piece of information
or a subset of that data or information.
Now, part of the responsibility of this role
is actually to determine the appropriate classification
of the information
to ensure that the information is protected with controls.
And now this is also done to periodically review
that classification and access rights,
and to understand the risk
associated to the information that they own.
The next one is the data custodian.
And basically this is an individual
that performs day-to-day task on behalf of the data owner.
And the main responsibility
is to ensure that the information is available
to the end user,
and to that the security policy, the standards,
and the guidelines are fulfilled across the organization.
Then there's also the system owner.
And the system owner is responsible
for the security of the systems
that handle and process information
owned by the different data owners.
And now their responsibilities are
to ensure that the data is secure
while it's actually being processed
by the system that they own.
Now, the system owner works closely with the data owner
to determine the appropriate controls
to apply it to that data.
Then there's also the security administrator.
And the security administrator manages the process
for granting access and rights to the information,
and that includes assigning privileges, granting access,
and monitoring and maintaining a record of access
by users and by systems.
And then lastly there's the end user.
And the end user is the final utilizer of the information
and they contribute to the security of the information
by adhering to the organization security policy.
Now, one thing to highlight is that besides these roles,
several other, could be also commonly seen
in a large organization.
So examples are things like security officers,
these guys are in charge for the design implementation
and management, and also review of the security policies,
and to organize and coordinate information,
security activities and information system,
security activities as well.
Now there's also
the information system security professional,
who is responsible to draft policies,
standard and guidelines related to information security,
and to provide guidance on new and existing threats.
You may also see in large organizations
folks that are auditors.
And auditors are responsible to determine
whether the owners, the custodians,
and the systems are compliant
with the organization security policies,
and they actually provide an independent assurance
to senior management
that everything is actually being established
in a correct way.