* NIST and RTI International launch a survey on the economics of access control targeted towards IT security, audit and compliance professionals
The National Institute of Standards and Technology and RTI International have launched a critical survey on the economics of access control targeted towards IT security, audit and compliance professionals.
Provisioning of users’ permissions, compliance with IT security and privacy laws, and maintaining and certifying access-control policies consume a large and increasing amount of time and effort by IT and business managers. In an exercise to understand how different approaches, or models, for access control influence the efficiency and effectiveness of firms’ IT and business workflows, NIST is sponsoring a survey on the economics of access control.
This survey is part of a larger study on access control policies that NIST is preparing to inform strategic activities for IT standardization committees and organizations, as well as to report to the broader IT community on the economic costs and benefits of critical IT security activities. In addition to provisioning, the study is reporting on the challenges organizations are having complying with information security and privacy provisions of regulations such as Sarbanes-Oxley and HIPAA.
The survey is intended for active professionals in access control and identity management, such as IT managers, senior systems administrators and information security architects, for example. Respondents should understand how their organizations provision permissions to their users and implement access control polices.
Question topics cover:
* Access control strategies, including access control lists, roles, and rules.
* Routine provisioning of user permissions.
* Access control policy design, implementation and maintenance.
* Compliance activities, including policy certification, permissions audits and attestation.
If you participate in the study, you will receive a complimentary copy of the final report and economic analysis. You may respond anonymously, however, you must provide your e-mail address to receive a copy of the study when it is released later in 2010.
At no time will any individual’s name, any company or university name, your participation, or individually identifiable response be released to any third party, including NIST. The survey and analysis is being conducted by RTI International, a nonprofit research institute. The survey can be accessed at http://accesscontrolsurvey.rti.org and is estimated to take between 20 to 30 minutes. Participate and you can help shape the future of standardized access control.
