A digital chipboard background with data points. A large lock with an X across it is centered on the top of the blue chip board.

Most application systems employ controls when accessing data that are generated, processed and/or stored. Primarily, these data are encrypted with industry standard algorithms together with setting user IDs and permissions to access these information to provide confidentiality. Two key differences are that access control enables the access rights to change over time and the authorization is separate from the data themselves. An encrypted file, in essence, embeds the authentication and authorization with itself. Without some additional system, there is no way to later revoke access once someone else has the password or key – it is not possible to take back a digital file.

Industrial espionage, nation-state hackers and organized crime are concerns for even the smallest organization. This has not, however, slowed the rate of data capture and sharing among partners, regulators and customers. Organizations now regularly share large quantities of proprietary data and employees’ or customer’s personally identifiable information. Heightened awareness by the board and increased regulatory pressure are leading to increased focus on and funding the data protection initiatives of the organization.

Most organizations today are comfortable deploying in-transit encryption. Unfortunately, there are many data transfer workflows outside of IT’s control or that must meet externally imposed requirements. As a result, critical and high-risk data still travel through email and attachments. All the more, users are also making use of both authorized and unauthorized cloud storage and file-sharing services. In case of extra-organizational file sharing, encryption on its own does not limit reuse or further sharing because the receiver can simply decrypt and discard the encrypted file or share the decryption password.

Clearly, encryption alone does not guarantee the confidentiality of data. A sound Access Control policy must cover all areas of exposures specially for controls involving human intervention like user IDs, passwords and permissions. It should also be implemented and compliance to it must be regularly monitored and reviewed. Periodic access revalidations or recertifications (automated provide optimum benefits) should be done to make sure that organization entities like employees, devices, groups, etc. have access to information that they need to perform their job functions even when there are changes in organizational structures or people movements.

The Crucial Role of Access Control in Data Protection

Services

Solutions

Pricing

Resources

Events

About Us

Get Started