A small tax filing company employs contractors for the tax season. Three contractors handle state taxes, and two of those contractors file federal taxes. The administrator needs to ensure that the two contractors have access to the state and federal forms for a select number of clients, and that the other contractor has access only to the state returns. The administrator has access to all client information.

The administrator applies access controls to the folders to limit the amount of access to what each of the contractors needs. It is also determined that each of these contractors will need his own account on the network. Limiting the amount of access for the three contractors ensures that the client information is kept secure and seen only by the appropriate user. Providing full access to everyone within the company would create risk that the administrator is not willing to accept.

Ensuring that each contractor has his own user ID allows for tracking in case a client is audited and the tax returns need to be reviewed. If additional access needs to be added for emergency purposes, the administrator grants the access on a temporary basis. The administrator also audits all of the activities to ensure correct access is provided.

These policies are shared with the clients, who feel secure knowing that the data will not get into the wrong hands. Implementing access controls proves successful for the company, and because the policy was documented and followed, updates can be done easily for each new batch of contractors.

This case study is an example of implementing a multilayer access control approach. The tax filing company defined the roles that each of the employees and contractors had within the organization and defined the access based on those roles. Each contractor was provided his or her own user ID for auditing as well, complementing the multilayer approach. The user role allowed contractors to see federal and state forms as appropriate, but they could not see every client’s forms.

The U.S. government manages millions of employees, consultants, and contractors. These entities are assigned identity credentials to access various agencies’ networks and systems. In many cases, individuals must remember a user ID and password for network access, and another user ID/password combination for each application they access. Although security personnel in each agency manage credentials for their users, the effort is still time-consuming and expensive. Overall security is also a concern. The current decentralized management of identities allows attackers to move from one system to another without their patterns being noticed right away.

For budgetary and strategic reasons, U.S. government security leaders have been collaborating on a project to create a centralized identity management system. The CIO Council lent a hand to the effort in 2009 by creating an implementation roadmap. The U.S. Department of Agriculture has already started a project to centralize 70 identity databases. Employees will receive a smart card and a PIN to access multiple databases rather than using unique credentials for each database as they do now. The Department of Homeland Security has started a similar initiative as well.

Some of the expected benefits of a centralized identity management system include:

• A more consistent approach to security
• A reduction of risk in inconsistent policy enforcement and mishandled passwords
• Reduced administrative expenses, including help desk calls to reset passwords
• Better cross-agency communications

Security leaders admit that the cost of implementation will be high, but they believe the cost of doing nothing may be even higher.

Reliant, a large healthcare facility, needed to upgrade its paper recordkeeping system to an electronic version. Knowing that the upgrade was needed, Reliant decided to implement a more secure infrastructure by using access controls to protect confidential information and upgrading its network configuration.

Access to the Reliant database is available through the corporate network. Employees use computers and handheld devices to access the data. Every patient at Reliant has personal data pertaining to him or her such as medical history, allergies, and blood type. Data such as patients’ likes and dislikes and emergency contact information is also available. Doctors and nurses are able to review all the medical information on every patient in the database. Some healthcare providers are only able to see patients’ history from the present date to 1 year back. Hospital volunteers are not able to see any patient medical histories but are able to see the emergency contacts as well as each patient’s likes and dislikes.

Reliant established an intranet for schedules, planned activities, food menus, and any updates pertinent to all. Access points were established for visitors and the handheld devices used by the doctors and nurses. The handheld devices were required to have an SSL VPN connection to ensure the communication was encrypted. The devices also required user IDs and passwords as a form of authentication. Biometrics were not considered because the staff often wore gloves, preventing the scanners from reading the fingerprints.

The information that is stored in Reliant’s system is confidential and must be kept secure. Access to the documents must be limited and constrained to only those individuals who have the rights to see it. Each user has a specific user ID that limits his or her access. Authentication and access are audited daily to ensure the constraints are in place and the patient data are not accessed. The access controls were carefully implemented and tested after every step to ensure they worked properly. Having volunteers see patients’ medical histories would have violated Reliant’s policy, and the healthcare facility could not risk access controls being set up incorrectly. Implementing the access control on the access points was essential as well. Ensuring that visitors were not able to access the intranet or any of the corporate resources was important. Providing encryption on the handheld devices protected the data from getting into the wrong hands.

All of these implementations for access control and encryption ensured the electronic version was safer than the paper records. It protected the patients, all healthcare providers, and the volunteers.