Access Controls An access control system

Application

By contrast, many corporations in the United States found that an unexpectedly high proportion of their Sarbanes-Oxley internal control issues came from IT. Separation of duties is commonly used in large IT organizations so that no single person is in a position to introduce fraudulent or malicious code or data without detection. Role based access control is frequently used in IT systems where SoD is required. Strict control of software and data changes will require that the same person or organizations performs only one of the following roles:

• 
  Identification of a requirement (or change request); e.g. a business person
  
• 
  Authorization and approval; e.g. an IT governance board or manager
  
• 
  Design and development; e.g. a developer
  
• 
  Review, inspection and approval; e.g. another developer or architect.
  
• 
  Implementation in production; typically a software change or system administrator.
  

To successfully implement separation of duties in information systems a number of concerns need to be addressed:

• 
  The process used to ensure a person's authorization rights in the system is in line with his role in the organization.
  
• 
  The authentication method used such as knowledge of a password, possession of an object (key, token) or a biometrical characteristic.
  
• 
  Circumvention of rights in the system can occur through database administration access, user administration access, tools which provide back-door access or supplier installed user accounts. Specific controls such as a review of an activity log may be required to address this specific concern.
  

In computing:

• 
  Server (computing), a server application, operating system, computer, or appliance
  
  • 
    server computer, a computer dedicated for server applications
    
  • 
    Application server, a server dedicated to running certain software applications
    
  • 
    Communications server, carrier-grade computing platform for communications networks
    
  • 
    Database server, see file AB2
    
  • 
    Fax server, provides fax services for clients
    
  • 
    File server, provides file services
    
  • 
    Game server, a server that video game clients connect to in order to play online together
    
  • 
    Home server, a server for the home
    
  • 
    Newsreader server, a server that feeds Usenet groups to client Newsreaders
    
  • 
    Name Server or DNS server
    
  • 
    Print server, provides printer services
    
  • 
    Proxy server, provides database server in services
    
  • 
    Sound server, provides multimedia broadcasting / streaming.
    
  • 
    Standalone server, an emulator for client-server (web-based) programs
    
  • 
    Web server, a server that HTTP clients connect to in order to send commands and receive responses along with data contents
    
  • 
    Web Feed Server, a server that distributes, manages, and tracks internal and external RSS feeds in an enterprise
    
  • 
    Client-server, a software architecture that separates "server" functions from "client" functions
    
  • 
    The X Server, part of the X Window System
    
  • 
    Peer-to-peer, a network of computers running as both clients and servers
    
  • 
    Catalog server, a central search point for information across a distributed network
    

Many servers have dedicated functionality such as web servers, print servers, and database servers.

Enterprise servers are known to be very fault tolerant, for even a short-term failure can cost more than purchasing and installing the system. For example, it may take only a few minutes' down time at a national stock exchange to justify the expense of entirely replacing the system with something more reliable.

Service Level Agreement (SLA)

A service level agreement (SLA) is a negotiated agreement between two parties where one is the customer and the other is the service provider. This can be a legally binding formal or informal "contract" (see internal department relationships). Contracts between the service provider and other third parties are often (incorrectly) called SLAs — as the level of service has been set by the (principal) customer, there can be no "agreement" between third parties (these agreements are simply a "contract"). Operating Level Agreements or OLA(s), however, may be used by internal groups to support SLA(s).

The SLA records a common understanding about services, priorities, responsibilities, guarantees, and warranties. Each area of service scope should have the "level of service" defined. The SLA may specify the levels of availability, serviceability, performance, operation, or other attributes of the service, such as billing. The "level of service" can also be specified as "target" and "minimum," which allows customers to be informed what to expect (the minimum), whilst providing a measurable (average) target value that shows the level of organization performance. In some contracts, penalties may be agreed upon in the case of non-compliance of the SLA (but see "internal" customers below). It is important to note that the "agreement" relates to the services the customer receives, and not how the service provider delivers that service.

SLAs have been used since late 1980s by fixed line telecom operators as part of their contracts with their corporate customers. This practice has spread such that now it is common for a customer to engage a service provider by including a service-level agreement in a wide range of service contracts in practically all industries and markets. Internal departments (such as IT, HR, and Real Estate) in larger organization have adopted the idea of using service-level agreements with their "internal" customers — users in other departments within the same organization. One benefit of this can be to enable the quality of service to be benchmarked with that agreed to across multiple locations or between different business units. This internal benchmarking can also be used to market test and provide a value comparison between an in-house department and an external service provider.

Service-level agreements are, by their nature, "output" based — the result of the service as received by the customer is the subject of the "agreement." The (expert) service provider can demonstrate their value by organizing themselves with ingenuity, capability, and knowledge to deliver the service required, perhaps in an innovative way. Organizations can also specify the way the service is to be delivered, through a specification (a service-level specification) and using subordinate "objectives" other than those related to the level of service. This type of agreement is known as an "input" SLA. This latter type of requirement is becoming obsolete as organizations become more demanding and shift the delivery methodology risk on to the service provider. SLA.