Question

Computer Security

Access Control List

There are a number of access control mechanisms that can be used to govern the ability of subjects to access objects.

You have been asked to design an access control system for a company, called EBook Company. The company has eight sales staff. Two of them are senior managers, S={S1, S2}, and the rest

are junior staff, J={J1, J2, J3, J4, J5, J6}.

The objects to be protected are four file directories, StaffSalary, BookCatelogues, PurchaseRecord and SaleRecord.

The two senior managers have read access to StaffSalary and read and write access to all other file directories. The junior staff have no access to StaffSalary, but has read access to PurchaseRecord and read and write accesses to BookCatelogues and SaleRecord.

• Draw an Access Control List (ACL) table to illustrate how the above mentioned

Answer 1

Access control list (ACL) is object centric that is we have a list corresponding to each file which is connected to access rights of each user that contains a list of rights given to that user.

There are two access rights in this case

• Read represented by R
• Write represented by W

Note that the list for bookCatalogues and SaleRecord are the same.

Please do comment in case of any clarification needed.