| Non-discretionary access controls are controls determined by policy makers, are managed centrally or by a central authority, and may not be changed at the discretion of ordinary application server users. Data protection requirements may result in a non-discretionary access control policy being specified as part of the application design.
Non-discretionary access controls are employed at the application server level in order to restrict and control access to application server data and to restrict management capabilities to specific users.
The policy rule set will specify that each application server user account be assigned attributes, including information such as position or role within the application server. (e.g., admin, operator, deployer).
It is not sufficient for these roles to simply exist within the application server - they must also be enforced. |
