Cyber security know how

Question

You are the IT administrator for an organisation with 100 employees. There are 4 senior managers with overall control of the business and 8 team managers. You have been asked to set up a user access control system for all employees. In the table below, explain the steps that you would take to create this system. You must consider the following in your response. [2.3]

1. Usernames and password allocation
2. Administration accounts and administrator permissions
3. Setting up file/folder permissions for you as overall admin, Senior managers and team managers.

Answer 1

Setting up a user access control system for an organization with 100 employees, including senior managers and team managers, involves several key steps to ensure security and appropriate access levels. Here's how you can approach each aspect:

1. Usernames and Password Allocation:
2. Usernames: Assign unique usernames to each employee based on a standardized format (e.g., first initial + last name).
3. Passwords: Implement a strong password policy requiring passwords to be complex (e.g., minimum length, combination of letters, numbers, and special characters).
4. Initial Setup: Provide initial passwords to employees upon account creation, which they should change upon first login to maintain security.
5. Administration Accounts and Administrator Permissions:
6. Administration Accounts: Create dedicated administration accounts for IT personnel responsible for managing user accounts and permissions.
7. Administrator Permissions: Assign full administrative permissions to these accounts to allow them to create, modify, and delete user accounts as well as manage system configurations.
8. Restriction: Limit access to administrator accounts to authorized IT staff only to prevent unauthorized changes to user access settings.
9. Setting up File/Folder Permissions:
10. Overall Admin (IT Administrator):
11. Access to all files and folders necessary for system management, configuration, and monitoring.
12. Full control permissions on critical system directories to ensure smooth operation and maintenance.
13. Senior Managers:
14. Provide access to files and folders relevant to their managerial roles, such as financial reports, strategic plans, and administrative documents.
15. Set permissions to allow read/write access to specific directories as required by their responsibilities.
16. Team Managers:
17. Grant access to team-specific files and folders needed for day-to-day operations and project management.
18. Customize permissions based on team requirements, allowing for collaborative editing and access to shared resources.
19. Employee Permissions:
20. Assign appropriate access permissions to employees based on their roles and responsibilities within their teams.
21. Ensure that employees have access to files and folders necessary for their job functions while restricting access to sensitive information not relevant to their duties.
22. Security Considerations:
23. Regular Audits: Conduct regular audits of user access permissions to ensure they align with current job roles and responsibilities.
24. Training: Provide training to users on best practices for password security, data protection, and recognizing phishing attempts.
25. Backup and Recovery: Implement a robust backup and recovery plan to protect critical data and ensure business continuity in case of data loss or system failure.

By following these steps, you can establish a structured user access control system that balances security with operational efficiency, ensuring that employees have the appropriate level of access to perform their duties effectively while safeguarding sensitive organizational information.