A proper access control strategy begins with identifying the methods by which it will be enforced. There are several approaches you can take when designing security; your first step should be in identifying which one fits your organization's needs, and designing the strategy accordingly. Let's start by breaking down the access control strategy into two parts:

• Access This strategy calls for granting fairly open access to files and resources and then locking it down according to need. This philosophy has its advantages but seems to give priority to the idea of access over security. Needless to say, this can pose a larger security threat to your network.

• Control This strategy gives priority to security and tends to start off by locking down resources to a maximum and then relaxing security gradually as the need arises. This approach ensures higher security but also makes it harder and more complicated to gain access.

So, which design strategy is right? There is no perfect answer for all situations; what you need is the perfect blend between access and control for your environment. You don't want to expose your resources unnecessarily, but you also don't want to lock down to the point where your design is unusable and impractical. Based on your company's nature and its approach to security, you should be able to formulate a good medium. However, we recommend that you select the most restrictive access control (often referred to as "least...