>> Okay guys, we're moving on to the next chapter.
Operational security.
Operational security has to do with
those things we do day-to-day for network security.
As part of this section,
we'll be thinking about things like redundancy,
policies and procedures, continuity planning,
incident response, and monitoring.
In this chapter,
>> these are the topics we'll be covering.
>> Personal security.
It's really important to get
our policies and procedures in place
and we want to make sure we have
the right policies for the right environment.
Reducing the attack surface.
This is about hardening our systems
and making our surface harder to attack.
The idea is that if you have
a very wide range of applications
and services and many ports open and so forth,
there is a greater chance for compromise.
But if you reduce that landscaper surface,
it is harder to attack your systems.
Incident response and forensic investigations.
Here we'll talk about monitoring the network and
determining what is an attack and what isn't,
and what to do from there. Fault tolerance.
This is redundancy in getting rid of
those single points of failure on the network.
Virtualization and cloud services go hand in hand.
BCP and DRP.
This is business continuity planning
and disaster recovery planning.
Let's get started with personnel security.
The greatest weakness to any organization
comes from the inside.
We have to be particularly careful with our employees.
We need a robust screening program for hiring
them and a good onboarding process,
as well as a good off boarding process
when they separate from the organization.
Non-disclosure agreements or NDAs,
give us a way to ask employees not to release
proprietary information about our organization.
Employees and an NDA commit not to
disclose this information to
anyone outside the organization.
AUPs or acceptable use policies
are for detailing how company resources are to be used.
For example, whether you are allowed
to print personal documents on the company printer,
and other rules that govern the use
of company property and equipment.
Privacy here refers to
our employees' privacy and
the organization's obligation to
inform employees about any monitoring that
the company does on the use of its systems.
The organization should notify
>> employees of how they are
>> monitored and how the use of
the organization's equipment is monitored.
Another item here is training.
Training goes a long way to preventing
fraudulent activity and security instance.
I mentioned earlier that social engineering is
such a major threat to organizations today.
That's where training can really help to inform
employees of what to watch out for and avoid.
Then of course, we have to have policies,
procedures, standards, and guidelines.
Some senior management can
state how the organization should work.
Usually when you're dealing with policies,
you're talking about organizational
or corporate policies.
Of corporate policies like, for example,
a policy to encrypt
all personally identifiable information on the network.
We might also have to have certain policies for
specific systems as well as for specific issues.
A system related policy might have to do with who gets
access to certain systems and at what level?
An issue specific policy is like the one I mentioned
earlier related to acceptable use, so,
in that example, it would state how a piece of
equipment or a system should
be used and the rules around that.