Reference no: EM133212107
Assignment - Authentication Best Decision Questions
To determine what type of authentication is best for different assets in different scenarios, one must first understand certain aspects surrounding the asset. To do this, one must know information regarding the identification, authentication, authorization, and the accountability related to the asset, as well as whether a physical or logical control is appropriate (Kim & Solomon, 2016, p. 315-316). Questions are good to answer to help with basic analysis: who, when, where, why, and how help to determine what security is necessary for protection. In many cases, a combination of physical and logical controls are implemented to ensure multi-layers of security.
1. For a doctor performing on-site clinical applications, the most appropriate type of access control would be utilizing a biometric method based on a physical or behavioral trait as a physical control. Protected health information must be kept confidential and with the practice being on-site, it makes the most sense to incorporate a personal control that is unique to that person who is on the spot. A code or a token would work as well, however, because those can be stolen and used to access the information, a biometric control is the safest for this scenario.
2. For an online patient portal, it is important for the patient themselves to hold the identifying information and be ablet to access it easily from their home or office as a logical control. A username and password set up by the user would be appropriate for this scenario. It would allow the flexibility to identify oneself online easily. Recently, more sites are having users integrate a Multi-Factor Authentication (MFA) method to ensure even more security for their medical information (Kim & Solomon, 2016, p. 326).
3. In a scenario regarding access to corporate intranet for professionals, especially dealing with proprietary information, it becomes even more important to control who has access to the information and utilizing a discretionary access control should be used for this. In this case, it is important to understand who needs access and how they can access such information. This should be protected using both physical and logical controls such as a security token as well as a personal pin or passcode. It is also important to be able to cut off someone's access immediately if found to be accessing the information for nefarious reasons or if they no longer have "need to know" level authorization.