Access Control Brick

Logical access control within NIH is provided at the network, operating system, and application level.

• Network Access Control. Network access controls can be provided by a variety of mechanisms both alone and in combination. However, the primary method of providing network access control in an enterprise environment is via a firewall. By1Q04, Gartner predicts that more than 50 percent of Fortune 1000 enterprises will have distributed firewalls internally.
• System Access Control. Access control can also be provided by the client or server operating system. Host access control can also be provided at the operating system level via third party products that are designed to enhance an operating system’s native access control facilities.
• Application Access Control. Application access control can be provided by either the underlying Data Base Management System (DBMS) or by the application itself.
• Content Filtering. Access control can also be based on content or sites. The motivation to block certain content or sites is driven by NIH acceptable use policy.

• Tactical and strategic products were selected to leverage NIH's investment in products that are a proven fit for NIH's known future needs. Leveraging baseline products in the future will minimize the operations, maintenance, support and training costs of new products.
• Some baseline products have been designated retirement and containment. These products are either not as widely or successfully deployed at NIH, or they do not provide as much functionality, value, or Total Cost of Ownership as the selected tactical and strategic products

Relevant Standards

• IEEE 802.10: Interoperable LAN/MAN Security (SILS)
• ISO/IEC 10164-9 System Management: Objects and Attributes for Access Control
• NIST Generally Accepted Principles and Practices for Secure Information Technology Systems

Relevant Policies

• CIT Security Handbook NIH
• FTP Server Policy
• NIH Guidance on File Sharing Security
• NIH NetBIOS Security Policy
• NIH NIHnet/Firewall Policy
• NIH SMTP Server Policy
• NIH SQL Server Policy
• NIH Web Server Policy
• DHHS Information Security Program Policy