In this section of the course,
we're going to discuss Documentation and Processes.
Now, when we discuss documentation and processes,
most of these are going to tie back
to a larger concept known as a policy.
Now, when I talk about a policy,
I'm not specifically talking about
technical controls anymore,
like adding access control lists
to our firewalls and routers,
or enabling MAC filtering, or enforcing encryption,
and things like that to better secure your network.
This is because technical controls
aren't the only way for us to secure our network.
In fact, a lot of our network protections
are going to come in the form of administrative controls,
such as policies,
and these policies are then documented
and translated into processes
that our network administrators will follow
when they conduct their daily work.
Now, policies are one part of a larger concept
known as IT governance.
IT governance is used to provide us
with a comprehensive security management framework
for our organizations to build upon.
This is done using policies,
standards, baselines, guidelines, and procedures.
Now, policies are going to be used
to define the role of security inside the organization
and establishes the desired end state
for that security program.
This is usually provided by your senior management,
and it's going to clarify the level
in which the organization will enforce security
and how the organization will categorize the controls
that are being applied.
Policies tend to be very broad,
and they provide the basic foundation
upon which the standards,
baselines, guidelines, and procedures are going to be built.
Now, security policies
are going to be further divided into three levels.
These are organizational,
system-specific, and issue-specific.
Organizational security policies
are going to provide direction and goals.
They're going to give you a framework
to meet the business goals and define the roles,
responsibilities, and terms associated with it.
System-specific policies are going to address the security
of a specific technology,
application, network, or computer system.
These system specific policies
will tend to be much more technical
and they tend to focus on protecting
a certain piece of the system
or a certain piece of technology.
Issue-specific policies are built to address
a specific security issue, such as email privacy,
employee termination procedures, or other specific issues.
As we move beyond policies,
we're going to enter the world of standards.
Now, standards are going to be used to implement a policy
inside of an organization.
These include things like mandatory actions,
steps, or rules that need to be followed and achieved
to be able to get the desired level of security
that you want in your network.
After standards, we have baselines.
And baselines are going to be used
as a reference point in our network architecture and design.
These baselines are going to be used to document
any kind of system,
and that way we can go back later
and compare it for analysis against the baseline.
For example, we may have a baseline configuration
for our network switches,
and then we can compare
the running configuration on any switch
to our baseline at any given time
to see what changes have been made by our administrators
or a possible attacker.
Next, we have guidelines.
Now, it's important to note that guidelines
are not required or mandatory actions,
but instead they're simply recommended actions
that we should do.
Guidelines tend to be very flexible in nature,
and they allow for exceptions and allowances
when a unique situation occurs.
For example, let's pretend I have a guideline
that every employee gets 1 terabyte of storage
on our cloud servers.
Now, that might be fine for most people who work here
like our salespeople, or our accountants, or folks like that
because they work mostly with text files
and those files are small in size.
Now, these users are going to have plenty of space
with that 1 terabyte of storage limit,
but my video editor might come up and say
they're running out of space
and they need 5 terabytes of storage.
Now, because our storage size limitations
are based on a guideline
and not a standard or a baseline,
we can actually make an exception to it
and allow the video editor to get 5 terabytes of storage
instead of 1 terabyte of storage
because they have the need for that
in their specific job role.
Next, we have procedures.
Now, procedures or processes
are going to be detailed step-by-step instructions
that we create to tell our personnel
how they can perform a given task or a series of actions.
Now, these procedures are where those high-level policies
are transformed all the way down
through the standards and guidelines
into actionable steps that we can take on a daily basis.
For example, your service desk
probably has a procedure
on how to create a new user account.
This procedure will encompass
all the security-related policies,
standards, and guidelines,
so that your frontline employees
will simply follow a step-by-step actions
necessary to create the user account
by following this procedure
and then give the account the proper permissions,
the correct password strength,
and all those other types of things.
For the exam, I want you to remember
the different types of policies
as we work our way down
from the more generic to the more specific.
This includes policies, standards,
baselines, guidelines, and procedures.
Now, as I said before,
in this section we're going to be focused
on documentation and processes,
and we're going to focus solely
on Domain 3: Network Operations
and Objective 3.1 in this section.
Objective 3.1 states
that you must be able to explain the purpose
of organizational processes and procedures.
Now, first, we're going to look
at common types of documentation
that you're going to use in your networks,
including things like physical and logical diagrams.
Then, we'll discuss asset inventories
and how they're used for tracking
our hardware, software, licensing,
and warranty support within our networks.
Next, you're going to learn about IP address management.
IP address management, or IPAM,
is a method used to plan, track, and manage the assignment
and use of IP addresses within our networks over time.
After that, we're going to explore some common agreements,
including a non-disclosure agreement
and a service-level agreement.
Then, we'll cover an overview of the product lifecycle,
including a discussion about end of life
and end of support considerations.
Next, we'll look at changes
and how they're implemented in our networks
using change management.
Now, change management is a systematic approach
to dealing with the transition or transformation
of an organization's goals, processes, or technologies
from one state to another.
After that, we'll explore configuration management.
Configuration management
is the process of maintaining
a consistent and functional state
of an organization's information technology assets
through version control
and the management of your environmental settings.
Then, we'll discuss patch management.
Patch management is a process of distributing
and applying updates to software
to correct security vulnerabilities
and improve their functionality.
Finally, we'll take a short quiz
to see what you learned during this section of the course
and review your answers
to ensure you know why the right answers were right
and the wrong answers were wrong.
So, if you're ready, let's get started with our coverage
of documentation and processes
in this section of the course.