INFORMATION SYSTEMS SECURITY
C845 – VUN1 Task 1
C845 – VUN1 Task 1
Student Name:
Student ID:
Western Governors University
A1. Recommended Access Control Model
The organization should implement a Role-Based Access Control (RBAC) model to govern the
user role matrix. RBAC assigns system privileges to users based on their defined job roles rather
than individual discretion. Under this model, access rights are directly tied to job responsibilities,
ensuring that users receive only the permissions necessary to perform their assigned duties (Wills,
2022).
RBAC provides several critical security advantages, including least privilege, separation of
duties, and role duration enforcement. Least privilege ensures that users do not possess excessive
permissions, while separation of duties prevents a single individual from controlling conflicting
system functions. Role duration enforcement allows privileges to be automatically revoked when a
role expires or an employee separates from the organization.
In the current environment, the organization lacks duration-based access controls and least privilege
enforcement. As a result, former employees still retain active system access, and junior-level
personnel have been granted excessive administrative privileges. For example, a junior system
administrator currently holds full domain administrator rights—authority that should be limited to a
small number of senior IT personnel.
Although the existing role matrix suggests an attempt to follow an RBAC structure, the absence of
enforcement mechanisms significantly weakens its effectiveness. Implementing a properly enforced
RBAC model would immediately reduce security risk and improve overall governance.
A2. Identified Misalignments with RBAC
Misalignment 1: Excessive Privileges for Junior System Administrator
, User: J. Lopez
Issue: Granted full Domain Administrator access
This assignment conflicts with RBAC principles because a junior system administrator does not
require unrestricted control over domain controllers. Such access violates the principle of least
privilege and exposes the organization to unnecessary risk.
Misalignment 2: Active Access for Terminated Employee
User: P. Ellis
Issue: Retained read/write access to HR and payroll systems after termination
This is a severe violation of RBAC role duration controls. Once an employee is terminated, all
system access should be immediately revoked. Retaining payroll access creates a significant insider
threat risk.
Misalignment 3: Payroll Access Assigned to Customer Support
User: J. Hall
Issue: Access to payroll system
RBAC requires separation of duties. A customer support representative has no legitimate business
need to access payroll data, making this assignment inappropriate and dangerous.
Misalignment 4: HR Coordinator with Financial Privileges
User: M. Singh
Issue: Read/write access to payroll system
While HR personnel require access to employee records, payroll systems fall under financial
controls. Granting HR write access to payroll violates separation of duties and increases the risk of
fraud or data manipulation.
A3. Security Recommendations and Justifications
Recommendation 1: Periodic Access Reviews
C845 – VUN1 Task 1
C845 – VUN1 Task 1
Student Name:
Student ID:
Western Governors University
A1. Recommended Access Control Model
The organization should implement a Role-Based Access Control (RBAC) model to govern the
user role matrix. RBAC assigns system privileges to users based on their defined job roles rather
than individual discretion. Under this model, access rights are directly tied to job responsibilities,
ensuring that users receive only the permissions necessary to perform their assigned duties (Wills,
2022).
RBAC provides several critical security advantages, including least privilege, separation of
duties, and role duration enforcement. Least privilege ensures that users do not possess excessive
permissions, while separation of duties prevents a single individual from controlling conflicting
system functions. Role duration enforcement allows privileges to be automatically revoked when a
role expires or an employee separates from the organization.
In the current environment, the organization lacks duration-based access controls and least privilege
enforcement. As a result, former employees still retain active system access, and junior-level
personnel have been granted excessive administrative privileges. For example, a junior system
administrator currently holds full domain administrator rights—authority that should be limited to a
small number of senior IT personnel.
Although the existing role matrix suggests an attempt to follow an RBAC structure, the absence of
enforcement mechanisms significantly weakens its effectiveness. Implementing a properly enforced
RBAC model would immediately reduce security risk and improve overall governance.
A2. Identified Misalignments with RBAC
Misalignment 1: Excessive Privileges for Junior System Administrator
, User: J. Lopez
Issue: Granted full Domain Administrator access
This assignment conflicts with RBAC principles because a junior system administrator does not
require unrestricted control over domain controllers. Such access violates the principle of least
privilege and exposes the organization to unnecessary risk.
Misalignment 2: Active Access for Terminated Employee
User: P. Ellis
Issue: Retained read/write access to HR and payroll systems after termination
This is a severe violation of RBAC role duration controls. Once an employee is terminated, all
system access should be immediately revoked. Retaining payroll access creates a significant insider
threat risk.
Misalignment 3: Payroll Access Assigned to Customer Support
User: J. Hall
Issue: Access to payroll system
RBAC requires separation of duties. A customer support representative has no legitimate business
need to access payroll data, making this assignment inappropriate and dangerous.
Misalignment 4: HR Coordinator with Financial Privileges
User: M. Singh
Issue: Read/write access to payroll system
While HR personnel require access to employee records, payroll systems fall under financial
controls. Granting HR write access to payroll violates separation of duties and increases the risk of
fraud or data manipulation.
A3. Security Recommendations and Justifications
Recommendation 1: Periodic Access Reviews
