Limitations of menu access control

You cannot rely solely on menu access control to protect your system and allow users to use the system effectively to do their jobs.

There are a number of limitations to menu access control. Computers and users have changed a great deal in the past few years. Many tools, such as query programs and spreadsheets, are available so that users can do some of their own programming, which lightens the work load of IS departments. Some tools, such as SQL or ODBC, provide the capability to view information and to change information. To enable these tools within a menu structure is very difficult.

As a security administrator who is trying to enforce menu access control, you have two basic problems:
  • If you are successful in limiting users to menus, your users will probably be unhappy because their ability to use modern tools is limited.
  • If you are not successful, you can jeopardize critical confidential information that menu access control is supposed to protect. When your system participates in a network, your ability to enforce menu access control decreases. For example, the LMTCPB parameter applies only to commands that are entered from a command line in an interactive session. The LMTCPB parameter has no affect on requests from communications sessions, such as PC file transfer, FTP, or remote commands.