Re: NCRS Emergency Board of Directors Meeting October 29, 2022
Keith,
Thanks for your informed points and insight...
I would only add to what you have presented (and you know this) that even "view" and "print" access for certain portions of protected data and information can be security weak points.
Without going into details, even locked pdfs and other protected software "views" can easily be extracted and post-processed if they are delivered to a user viewing it on a screen and the user knows how to do it...
Rob Musquetier had it right when he stated what I consider to be the gold standard of controlling database access - proof of "Need-to-Know" for the "business requirements" must be demonstrated for the sub-parts of "access" you mention. Increased security of information that needs to be protected is inversely proportional to the number of people (roles and responsibilities) who are granted access to it (even if it's only a "view" or "print).
Keith,
Thanks for your informed points and insight...
I would only add to what you have presented (and you know this) that even "view" and "print" access for certain portions of protected data and information can be security weak points.
Without going into details, even locked pdfs and other protected software "views" can easily be extracted and post-processed if they are delivered to a user viewing it on a screen and the user knows how to do it...
Rob Musquetier had it right when he stated what I consider to be the gold standard of controlling database access - proof of "Need-to-Know" for the "business requirements" must be demonstrated for the sub-parts of "access" you mention. Increased security of information that needs to be protected is inversely proportional to the number of people (roles and responsibilities) who are granted access to it (even if it's only a "view" or "print).
Comment