MECHANISM FOR MANAGING ACCESS TO INFORMATION RESOURCES AT AN ENTERPRISE

The article discusses the issue of protecting enterprise information by controlling access to it. The main access management models are analyzed, including: Role-Based Access Control; Attribute-Based Access Control (ABAC); Identity and Access Management (IAM); Mandatory Access Control; Discretionary Access Control; Hybrid Access Management (combination of different access management approaches that allow organizations to create more flexible and effective access control strategies for information resources); Identity-Based Access Control (IBAC); Purpose-Based Access Control (PACF); Next Generation Access Control (NGAC) and Blockchain-Based Access Control, which integrate modern technologies such as blockchain and distributed systems. The advantages and disadvantages of the considered models of access management for information resources in the enterprise are presented. The Law of Ukraine “On Personal Data Protection”, namely its part concerning the guarantee of preserving the privacy of information, is considered. It is noted that the Law of Ukraine on “Fundamentals of the Legislation of Ukraine on Healthcare” stipulates the rules for the treatment of patients’ information by medical institution employees, which necessitates the need to determine the purposes of collecting client data and access to them. A mechanism for managing access to information resources of an enterprise (in the healthcare sector) with defined goals, tools and technologies for access management, role distribution and access policies recommended by the regulatory field is proposed.