Who should be able to access a company’s data? Under what circumstances do organisations deny access to a user with access privileges? To adequately protect data, an organisation’s access control policy must solve the issues presented by these questions. It is critical to understand the basics of access control – what it is, why it’s needed, which organisations require it the most, and the challenges it poses. Access control is the process of identifying and then subsequently granting access to individuals trying to access an organisation’s data. At an advanced level, access control is a selective restriction to information. There are two main components – authentication and authorisation. Authentication is a technique used to confirm an individuals identity; however, one could argue that this isn’t sufficient by itself to protect data. What is needed is another layer of authorisation that controls whether a user should be allowed to access the information or continue with the trans...