Customer Needs Assessment
Overview
Overview
As described in Chapter 1: “Access Control Concepts,” network access control is more than just granting legitimate users access to the network while blocking unauthorized people. Although you must identify the users who need access to your company’s network, you must go beyond this first step to determine:
■What data, services, and other resources should these users be able to access?
■What conditions should alter the level of access granted to a particular user?
To answer the first question, you must focus on the user. You must determine what network resources each user needs to complete his or her job. You may need to interview users, create user committees, or use questionnaires to gather this information. Whichever method you use, keep in mind that the more you communicate with users, the better. (For more information about working with users, see “The Human Factor” on page
You should ensure that users can access only the network resources they need to complete their work successfully. By granting users the minimum network access they need, you limit the damage a disgruntled or untrustworthy employee can cause. You also minimize the damage a hacker can cause if he or she breaks into a user’s account.
For example, if a user can access any network resource and a hacker discovers his or her username and password, that hacker can cause massive dam-
To answer the second question, you must concentrate on the company and its network. You must try to protect the network and your company by minimiz- ing the risk of network attacks.
You must set up other controls as necessary to limit network access. For example, you may need to allow some users to access the network only on certain days or at certain times. Other users may need to be restricted to accessing the network from certain locations.
