Policy
Access Control
Access Control protection measures provide the organization with the capability to restrict the accidental or intentional unauthorized use of or alteration to, information assets.
System administrator shall be responsible for creating and implementing Logical access control procedure. Terminals will be identified through unique IP addresses.
Function Heads / HR approval is required to authorize issuance of user IDs and resources privileges.
Only authorized users shall be allowed access to the information systems of the organization.
The System administrator shall periodically review the Access control system
The basic principle of access control is that access to information will be granted on a need to know or need to have basis, as per job functions.
Access controls must be applied to enforce a separation between software developers, software testers, system/security administrators, database administrators, support operators, management and end users.
In environments where this separation of function is not feasible, compensating controls must be used to manage and document these functions, including logging and audit trails to record the actions of administrators.
In the event that an emergency fix must be made to production data, a higher level of access may be granted to a developer through an approval and authorization procedure. An audit trail must record granting and removal of the additional access.
Requests for access to information resources must be submitted to Internal Ticketing System by the employee’s project leader or Process Owners. System admin will review the request, create the necessary user accounts, as needed for granting application specific access
Access to Networks and Network Service
The Logical and Physical network diagram along with data and electrical cable layouts of all offices shall be documented. These diagrams shall clearly indicate the logical connections and physical locations of the equipment’s on the network including hosts, switches, routers, VPN tunnels and servers. A clear description of the security attributes of all network services used by the organization shall be provided.
The authentication process will permit access to only predefined sections / domains. This access definition is drawn based on the role and function of the employee that determines the level of access required. The access ids and passwords are recycled as per Password policy.
Physical Access
Perimeter security mechanism and devices installed at the site provide for the physical access control of the employee movement in and out of the premises. Registers of employee movements are maintained and verified on monthly basis.
Granting and denying of physical access to employees is under the sole discretion of the management. Within the premises the employee access to zones is determined by their role and function.
Employees are strictly prohibited from entering zones separated as “Restricted Access” without prior permission.