Howdy, I'm done with the assignment. Find it attached to this message. ALL THE BEST!!regardsTutor_Khloe25

CST 620 Prevention of Cyber Attack Methodologies
Project 4 – System Security Controls

Security Control Implementation Report
Template
Prepared By: Pramod Thomas

Version 1.0

1. Introduction
Access control is an important aspect when it comes to organizational security with this
going down to the fact that different people in an organization have different clearances and the
need to assign privileges according to clearance levels (Powell et al., 2022). With the control
over access, companies can control the impact of insider attacks in that in case of an insider
attack, the attacker will only gain access to resources that they have clearance to access. Access
control in some organizations has also been used in other aspects other than security in that for a
company using cloud services, access control helps to limit requests for resources and thus cost
savings for the company. Implementing access controls revolves around securing resources
through the use of security groups, roles, and permissions allowing easy classification and
assigning roles to for example a department, or to individuals like system administrators who
usually get the highest privileges.
To control individual access, we introduce identity and access management controls
(IAM) which is simply a set of technologies and practice that are designed to ensure that every
individual accessing a system is assigned privileges and only have access to resources they need
to fulfill their tasks. IAM brings together various features to authenticate and give authorization
to these users to access the computing resources. Authentication and authorization are two
factors in access control that are used together where authentication simply implies the user
proving that they are the owner of the account while authorization lies in the access that they are
given after being authenticated (Grassi et al., 2017). Operating systems like Windows provide
this form of access control in that by authentication, a user keys in their credentials to access
their user accounts, and thus the fact that authentication needs a user account. To introduce
authorization, windows allow setting policies and assigning permissions to different users and

thus control what they can do in the operating system once they are authenticated. This feature
can be used in an organization to control what users can do once logged into their organization’s
computer like install software, change rights, etc.,

2. Windows Local Account and Group Security Best Practices
i.

Strong passwords – user authentication is based on allowing users access to their
accounts using credentials that they have that can prove they are the owners. To help
protect users from attacks like brute force attacks, users are encouraged to use strong
passwords which help to make it harder for attackers to decrypt. To help ensure this,
some applications have a password policy defining the length and characters of
passwords that help users come up with stronger passwords.

ii.

Least privilege principle- the least privilege principle works on the account that accounts
are assigned the minimum necessary privileges that they need to perform tasks by default
and thus accounts with higher privileges like administrators cannot be used for normal
tasks (Wilson et al., 1998).

iii.

Disable unnecessary accounts – idle and unnecessary accounts form an avenue for
possible attacks. They must delete any guest accounts that are not required and thus
ensure that every account existing within the computing environment is assigned the
necessary privileges.

iv.

Use security groups – security groups are a good way of passing similar permissions and
rights to different users and in turn also managing this permission. Security groups make
it easy to add and remove permissions for users with similar resource requirements e.g.,
in departments.

v.

Regular audits – security audits generally work to ensure that the set policies are being
adhered to and if there is a need for change, the changes can be implemented. Regular
security reviews help to ensure that the security policies are working as expected and the
company can remove unused and unnecessary user accounts.

vi.

Monitor...