Enforcing Authorised Use and Protecting Sensitive Assets
Introduction
Restricting access to information and other associated assets is paramount for maintaining confidentiality, integrity, and availability. By aligning with the organisation’s established policies on access control, unauthorised access can be minimised, and sensitive information can be safeguarded from potential breaches.
Purpose
The goal of information access restriction is to ensure that only authorised users, processes, and applications can gain access to sensitive data and systems. This not only protects critical resources but also helps maintain regulatory compliance and fosters trust in the organisation’s security posture.
Fundamental Access Restriction Practices
No Anonymous Access to Sensitive Data
Prohibit unknown or anonymous users from accessing any sensitive information.
Permit public or anonymous access only in storage locations that contain non-sensitive data.
Configurable Access Controls
Provide mechanisms to customise access levels in systems, applications, or services.
Determine which data can be accessed by each user or role.
Define permissions (e.g., read, write, delete, execute) based on job functions.
Physical or Logical Isolation
Implement physical or logical controls to isolate sensitive applications, data, or systems from general access.
Dynamic Access Management
Dynamic access management adds real-time, context-based controls to the traditional access control framework. It is especially relevant for highly sensitive information that needs granular, adaptive protection throughout its lifecycle—including creation, processing, storage, transmission, and disposal.
When to Consider Dynamic Access Management
Fine-Grained Control: Granular oversight of who can access information, when, and in what manner.
External Sharing: Maintaining control over sensitive data shared with external parties.
Real-Time Governance: Enabling on-the-fly updates to permissions and usage policies.
Protection Against Unauthorised Copying/Distribution: Restricting print, copy, or change functionality.
Monitoring and Auditing: Logging how information is accessed and used, to support investigations.
Core Components of Dynamic Access Management
Access Rules
Use identity, device characteristics, location, or application context to grant or deny access.
Leverage the organisation’s classification scheme to determine which data requires dynamic protection.
Technical Infrastructure
Operate monitoring and reporting processes to track how protected data is handled.
Use encryption and secure communication channels to guard against interception.
Dynamic Protections
Require re-authentication or special credentials for access.
Limit usage to a specific time frame or expiry date.
Control printing and copying permissions.
Alert administrators if misuse is detected.
Supporting Measures
Audit Logs: Document all access attempts and usage of sensitive information to facilitate investigations.
Conditional Access: Incorporate contextual factors (e.g., user location, device security posture) into decision-making.
Incident Response Integration: Enable rapid revocation of privileges or policy changes in response to emerging threats.
Additional Considerations
Dynamic access management works alongside, not as a replacement for, traditional access controls such as access control lists (ACLs).
By extending security measures to files and documents beyond the organisation’s perimeter, dynamic access management helps maintain data confidentiality even when information leaves a controlled environment.
For guidance on broader access management frameworks, refer to ISO/IEC 29146.
Conclusion
Information access restriction lies at the heart of a robust security strategy. By implementing both traditional and dynamic access control measures, organisations can effectively minimise unauthorised access while providing employees, partners, and external stakeholders with the permissions they need to perform their roles. Continuously monitoring and adapting these measures in line with organisational and regulatory changes ensures that sensitive assets remain well-protected.
Comments