In this assignment, you’ll develop a matrix that shows Business Roles in the first column, followed by the privileges for that role. Look for common rights in the previous assignment to help determine the roles that require those rights. Try to avoid building roles that are too coarse (everyone is a member) and roles that are too fine (only one person is a member). Once you have the matrix close to where you deem it

WEEK 5
ASSIGNMENT – ACCESS CONTROL MATRIX DEVELOPMENT
PURPOSE OF ASSIGNMENT
This assignment is the second step in developing your portfolio project. You’ll start by identifying the access that’s needed for employees throughout CreditWon’s credit card operation centers. You’ll be developing a matrix that shows Business Roles in the first column, followed by the privileges for that role.

SCENARIO
CreditWon Inc. is a Visa credit card issuer for college graduates and first-home buyers. They offer affinity discounts and special deals to their customers related to items and purchases that college grads typically make and have a lower threshold for granting credit to applicants. CreditWon has 14,000 employees nation-wide across all roles, as well as five Operations and Processing Centers.
CreditWon operates the entire process for credit card operations, including:
• Application processing
• Card issuance
• Billing and collections
• Fraud investigations
• Telephone and web service (first line)
• Customer Service (second line for issues that cannot be resolved on first attempt)
• IT (application development, operations, enterprise architecture, office of the CISO, desk-side support, etc.)
• Human resources
• Accounting and Finance
CreditWon uses an information classification scheme to appropriately handle, manage, and store business-related information:
Level 1, Public: No need for rigorous protection.
Level 2, Internal: Business information for daily operations, including purchase orders, billing data, employee basic information, etc.
Level 3, Sensitive: Customer nonpublic information (NPI), including SSNs, credit report data, sensitive employee data, protected business information, etc.
Level 4, Highly Confidential: Corporate future plans, unpublished financial statements, trade secrets, etc.
Today, CreditWon uses a variety of mechanisms to control access to computing services from a series of acquisitions made over the years for functions and processing that were brought in but never fully integrated into the back office systems, which are based on Microsoft products. Access Controls are granted using Discretionary Access Controls (DAC) implemented as Access Control Lists (ACLs) on EACH application that internal users require to perform their duties.
Since CreditWon is a large call center, there is a high volume of turnover and seasonal hiring corresponding to college graduations around the country. Each time an employee is hired, leaves, or moves to another position, every ACL that contains their rights must be updated, leading to many errors in which privileges that should be removed are not or where privileges that are needed are not granted. Account Administrators in the business unit and the Security Team are increasingly strapped for time to maintain the proper access rights across all systems and users.
Management has decided that a new-and-improved approach is needed for today’s access needs. CreditWon is also planning for future growth with new SaaS applications and application migrations to the Cloud that improve the customer experience.
The Security Team has been brought in to perform an analysis of the problems leading to access control issues and to develop a strategy to begin the modernization efforts.
As part of the Security Team, you are being asked to perform the following in a series of assignments that lead up to the term’s Portfolio Project for a Single Sign On, Role-Based Access Control system for Microsoft’s Active Directory (AD), and will work on internal applications and Azure Cloud-based applications that CreditWon develops.

ASSIGNMENT INSTRUCTIONS
In this assignment, you’ll develop a matrix that shows Business Roles in the first column, followed by the privileges for that role. Look for common rights in the previous assignment to help determine the roles that require those rights. Try to avoid building roles that are too coarse (everyone is a member) and roles that are too fine (only one person is a member). Once you have the matrix close to where you deem it complete, one last step is to resolve incompatible rights and excessive privileges. Justify your decision to use Discretionary Access Controls over Mandatory Access Controls to convince management that the effort is on the right track.
Review the matrix to determine whether the rights tied to each role preserve the principles of Separation of Duties and Least Privilege. Look for areas where you may find roles where creating a transaction also permits approving the transaction. For example, in the Accounting Department, you don’t want any roles with rights to approve an invoice for payment and issue a request for a check to be sent. Where you find conflicts or incompatible rights, highlight these problems and document recommendations for management to resolve or create new roles to resolve conflicts.

FORMATTING AND STYLE REQUIREMENTS
• Submissions should be between 500 words and 800 words in length.
• Refer to the UCOL Format and Style Requirements (Links to an external site.) on the Course Homepage, and be sure to properly cite your sources using Turabian Author-Date style citations (Links to an external site.).