Teaching System Access Control

Many specialists believe that more emphasis on system infrastructure is needed, including the protection of the system’s data against unauthorized use or updates. This paper proposes a way to teach future information system specialists the main concepts involved, using a powerful yet very flexible method to implement access control. Constraints, widely known as context constraints, which depend on the value of a variable or data item, are included. We discovered it was extremely difficult for students to understand, let alone adopt, a model as general as the one we use to explain the necessary ingredients of an Access Control model. However, the order in which the concepts were introduced produced a very significant increase in the degree of understanding on the part of the students. Rather than just provide another method, the paper’s objective is to promote discussion as well as further study of the subject.