Designs access by need, with duties segregated and masking that holds

https://knobit.org/id/outcome/SO-3

dcterms:description	Stage 3 of the data-security skill: Designs access by need, with duties segregated and masking that holds; produces 03-access/access-model.yaml. en
dcterms:identifier	SO-3
dcterms:license	https://creativecommons.org/licenses/by/4.0/
has prerequisite	Classifies every column, derived ones included, at the level its data demands
includes knobit	Explains segregation of duties
includes knobit	Recognises a restricted column without access design
includes knobit	Recognises a role granting more than its jobs require
includes knobit	Recognises a toxic combination in one role
includes knobit	Recognises a toxic combination across a job's roles
includes knobit	Recognises masking a join can undo
includes knobit	Recognises row security on an updatable column
includes knobit	Recognises a privileged role with no logging
includes knobit	Recognises break-glass access with no expiry
includes knobit	Recognises an access role with no owner
includes knobit	Recognises an administrator reading restricted data
includes knobit	Recognises masking applied to one copy only
includes knobit	Recognises a shared privileged account
includes knobit	Splits a toxic combination into separate roles
includes knobit	Closes the clear-text paths around a masked column
includes knobit	Removes excess entitlements while keeping every duty covered
includes knobit	Explains least-privilege access design
includes knobit	Explains data masking and its limits
includes knobit	Explains privileged and emergency access
includes knobit	Explains row-level security
owl:sameAs	https://bitbucket.org/reffa/ontology/id/outcome/data-security/03-access-control
rdfs:label	Designs access by need, with duties segregated and masking that holds en
rdfs:label	Kavandab juurdepääsuõigused vajaduspõhiselt, ülesannete lahususe ja töökindla maskeerimisega et
related topic	Data security (DAMA-DMBOK2 chapter 7)

Used by

assesses learning outcome	Bank role and entitlement design - masking bypass and segregation of duties (access control anomaly skills)
assesses learning outcome	Collections access design with an outsourced agency - SoD across a job's roles, masking on every copy, restricted columns (access design skills)
has prerequisite	Monitors access with logs its subjects cannot alter and recertifications its holders do not sign
includes learning outcome	Learning path: Data security
related learning outcome	Stage 3 — Access control design
related learning outcome	Access control design anomaly checklist
schema:item	https://knobit.org/id/path/data-security/SO-3