WGU C845 TASK 1 - C845 Latest Update with Complete Solution

WGU C845 TASK 1 - C845
Latest Update with Complete Solution
Access Control Model zr zr




A1. Chosen Model and How It Fits
zr zr zr zr zr zr




I am applying Role-Based Access Control (RBAC) to FinSecure Corp.
zr zr zr zr zr zr zr zr zr




In RBAC, access is tied to roles, not to individual people. Users get permissi
zr zr zr zr zr zr zr zr zr zr zr zr zr



ons based on what their job is, not on ad-hoc requests. Key ideas:
zr zr zr zr zr zr zr zr zr zr zr zr




• People in the same role (e.g., finance analyst, HR coordinator) should
zr zr zr zr zr zr zr zr zr zr zr


have similar access. zr zr




• Users should have only what they need to do their job (least privilege).
zr zr zr zr zr zr zr zr zr zr zr zr




• Access should change when they are hired, moved, or leave.
zr zr zr zr zr zr zr zr zr




The provided user matrix already uses job titles like “Finance manager,” “C
zr zr zr zr zr zr zr zr zr zr zr



ustomer support rep,” “Junior system admin,” which map naturally to RBAC
zr zr zr zr zr zr zr zr zr zr z



roles. The gaps show up when the access no longer matches the role or whe
r zr zr zr zr zr zr zr zr zr zr zr zr zr zr



n accounts stay active after the person is gone.
zr zr zr zr zr zr zr zr




A2. Misalignments with RBAC
zr zr zr




Here are four clear misalignments between the matrix and RBAC:
zr zr zr zr zr zr zr zr zr




1. Customer support rep with payroll access (J. Hall) zr zr zr zr zr zr zr




o Role: Customer support rep (Support)
zr zr zr zr




o Access: CRM, email server, payroll system
zr zr zr zr zr




o Problem: Payroll is a finance/HR function. A support rep doesn’t
zr zr zr zr zr zr zr zr zr zr



need payroll data to help customers. This breaks least privilege
zr zr zr zr zr zr zr zr zr zr



and mixes duties across roles.
zr zr zr zr




2. Terminated HR assistant still active (P. Ellis) zr zr zr zr zr zr




o Role: HR assistant zr zr




o End date: 2025-05-20, marked “Terminated (2025-05-20)”
zr zr zr zr zr




o Account status: Active, with HR portal and payroll system access
zr zr zr zr zr zr zr zr zr




o Problem: In RBAC, access should end when the role ends. Kee
zr zr zr zr zr zr zr zr zr zr



ping an active account for a terminated employee is a serious mis
zr zr zr zr zr zr zr zr zr zr zr



alignment and creates an easy path for misuse. zr zr zr zr zr zr zr




3. Junior system admin as Domain Admin (J. Lopez) zr zr zr zr zr zr zr


messages.downloaded_by

, o Role: Junior system admin
zr zr zr




o Access: Domain controller, all internal systems
zr zr zr zr zr




o Privilege level: Domain admin zr zr zr




o Problem: A “junior” admin should not have full domain-
zr zr zr zr zr zr zr zr



wide control. This is too much access for the role and violates
zr zr zr zr zr zr zr zr zr zr zr zr



least privilege and basic admin tiering.
zr zr zr zr zr




4. Shared reporting account (report_ro)
zr zr zr




o Role: Read-only reporting
zr zr




o Assigned user: Shared zr zr




o Access: Budget tracker, finance reports
zr zr zr zr




o Problem: Shared accounts break individual accountability. With R
zr zr zr zr zr zr zr



BAC, roles are assigned to real people so actions can be traced. A
zr zr zr zr zr zr zr zr zr zr zr zr zr



shared login makes that impossible.
zr zr zr zr




A3. Recommended Changes (with Justification) Chang
zr zr zr zr zr




e 1: Limit payroll access to finance/HR roles
zr zr zr zr zr zr zr




• What to do: zr zr




o Remove payroll system access from J. Hall (customer support).
zr zr zr zr zr zr zr zr




o Ensure only finance and HR roles (e.g., finance manager, finance
zr zr zr zr zr zr zr zr zr zr


analyst, payroll specialist, HR coordinator) have payroll access.
zr zr zr zr zr zr zr




• Why it helps:
zr zr




o Follows least privilege and separation of duties, as recommended
zr zr zr zr zr zr zr zr zr



in NIST SP 800-53 (AC-5, AC-
zr zr zr zr zr



6) and CIS Controls (account management and data access).
zr zr zr zr zr zr zr zr




Change 2: Enforce account deactivation on termination
zr zr zr zr zr zr




• What to do: zr zr




o Disable the P. Ellis account and remove HR portal and payroll
zr zr zr zr zr zr zr zr zr zr zr



system access. zr




o Tie accounts to HR records so termination dates automatically
zr zr zr zr zr zr zr zr zr


trigger deactivation for employees and contractors.
zr zr zr zr zr




• Why it helps:
zr zr




messages.downloaded_by