Text · page 4 of 12
Access to the Network and Information Applications User accounts identify specific users and accounts. Network user accounts provide access to resources on a network1 and are managed centrally by a server computer and/or domain controller.2 Application user accounts provide users with access to resources within each information application, such as a financial application or a student information application and are managed by the application server.3 How Should District Officials Secure Access to the Network and Information Applications? To minimize the risk of unauthorized network and application access, the Director should actively manage network and application user accounts and periodically conduct a user account review and any account that cannot be associated with an authorized user or current District need should be disabled. Officials should have written procedures in place to grant, change and disable user permissions to the network and applications. These procedures should establish who has the authority to grant or change user permissions and allow users to access only what is necessary to complete their job duties. User permissions should be updated as necessary and unneeded accounts should be disabled in a timely manner. Because generic accounts are not assigned to a single user, officials may have difficulty managing these accounts and linking any suspicious activity to a specific user. To help ensure individual accountability, all users should have and use their own user account to gain access to a network and applications. If generic accounts are needed, officials should have procedures in place to monitor who uses the accounts and when they are used. The Director should set up user accounts with specific user permissions needed by each individual to perform their job functions. Properly assigned user access rights, based on the requirements of an individual’s job responsibilities, help to preserve an appropriate segregation of duties within the network and applications. The Business Administrator should periodically review user permissions in the financial application to ensure permissions are appropriate and properly limited based on each user’s current job roles and responsibilities. 1 A network is a group of two or more connected computers. Network resources include those on networked computers, such as shared folders, and in certain applications, such as an email application. 2 A server is a computer equipped with specific programs that provide resources and data to other computers which are connected to the server. A domain controller is the main server computer in the domain (network) that controls or manages all computers within the domain. 3 An application server is a program on a server computer that handles all application operations between users and an organization’s back-end applications or databases. The front-end is the user interface, typically web-based, where users input information and make information requests. The back-end is the application and database on the server that delivers information to users. 2 Of f ic e of t he New York State Comptroller