>> After talking in the last section about
the importance of diagrams, change management,
and configuration management in your workplace,
we're now going to look at
>> some other policies and best practices.
>> Starting off, we want
>> to talk about our privileged users.
>> In Unix, we have root and in Windows,
we have administrator.
>> Those are two all-powerful accounts,
>> or at least they can be.
What we want to do is monitor
these accounts and limit administrative privileges.
We don't want a single individual to be all powerful.
Rather than having a single admin,
we want to split administrative efforts
across multiple administrators.
We want to make sure that, for instance,
if someone can lock user accounts,
somebody different can unlock them.
That goes in with separation of duties as well.
We always have to talk about password policies
>> because passwords are really the weakest link
>> in most environments today.
It really needs to be stressed that passwords alone
are no longer providing
the amount of security that we need.
Any eight character password
>> can be compromised in a matter of days.
>> If we're going to use passwords,
we want to bring in
>> some other factor of authentication.
>> Smartcards, biometrics, tokens,
any additional security
>> and multi-factor authentication is best.
>> For passwords, we do want to include rules
>> and make sure that we're
>> securing our passwords and encouraging
our users to use strong passwords.
What's very interesting is this list at
one in time was thought to be
the best practice for passwords.
NIST has actually now come out
>> and said, the zoos suggestions
>> that we gave you for passwords,
>> we were wrong.
>> Take some time to Google NIST passwords revised
>> or password policy revised.
>> Basically what NIST is saying
>> is that we've traditionally accidentally
>> made passwords easier for attackers
to guess and harder for us to remember.
Most of the software that attackers are going
to use already scans for upper and lowercase
>> and Alphanumeric and non-Alphanumeric characters.
>> Just by adding these and making these more
complex does not make them more secure.
It's important to understand complexity
>> does not equal security.
>> What NIST's recommending now
>> is to force people to have longer passwords
>> rather than more complex passwords.
>> Ultimately, that was what adds the entropy
>> to the password cracking
>> which makes it more difficult.
>> If possible, get away from making
these passwords so difficult
>> that people write them down,
>> tell users to pick up four words.
>> Those four words together are your password.
>> I'm going to get something like
30-some characters just on average.
That makes it very difficult for
an attacker to compromise passwords.
We need to get away from
these single factor authentication.
We need policies for onboarding and offboarding,
bringing people into our environment,
but also handling it professionally
when people leave our environment as well.
We've got to have a process.
For onboarding, we want to make sure that
we check references, certifications,
meet with employees, have them sign
non-disclosure agreements and that
we go over the employee handbook.
When people are leaving,
whether voluntarily or through termination,
we also need a professional process
>> that's documented to make sure
>> we retrieve any company material.
>> We revoke credentials, remind
employees of their non-disclosure
agreement that was signed,
and conduct any exit interviews and necessary.
We have to be aware in an organization about licensing.
At one in time there's a lot
of funny business in organization,
is about software licensing
>> and only took so many disgruntled employees
>> before organizations realize the importance of
>> making sure that their software is properly licensed.
Vendors will come in and conduct audits
>> and confine you quite substantially in the event that
>> the licensing isn't handled properly.
We want to make sure
>> that we keep track of our software licenses
>> and there's a process in place to guarantee
>> we're not using unlicensed software.
Data loss prevention systems are very helpful tools.
The purpose here is to detect and possibly
prevent extra filtration of data from the network,
also known as data loss.
You may also hear it called data leakage.
>> What these systems do is they look for
>> certain types or formats of data.
>> They can prevent those data types
>> from being printed, emailed, or extra filtrated off
>> the network and sent through the Internet.
>> The types of information they would look for
>> specifically would be things
like Social Security numbers,
credit card information,
>> or any other information
>> that we really want to keep on tabs
>> and to make sure it doesn't leave our network.
>> We have to think about mobile devices policies.
People want their devices brought into the network.
I want to use my tablet,
my smartphone, bring my laptop from home, and so on.
What we have to consider is the fact that
>> when these systems are not under our control,
>> we don't really know what happens with them
>> or what they're used for
>> outside of our work environment.
>> Even though this is becoming very prevalent,
there are certain ways that are better than others
>> to address the idea of bringing your own device.
>> For one, we can isolate BYOD devices
>> to their own subnet.
>> We create a view land for bringing your own devices.
People can come in and access the Internet,
but can't interface with the corporate network.
That's really good for Wi-Fi clients
>> where people just want to come in
>> and browse the Internet on their phone or tablet.
>> There are some other implementations,
like personally owned corporate enabled.
Essentially it's enabled for use in the workplace,
but it is your device.
Whereas corporate owned, personally enabled,
the company owns the device.
But unless you take it home, for instance.
Here's your laptop.
>> You can take it home.
>> You can use it for personal use,
>> but the company remains the owner of it.
Sometimes organizations will let you
>> choose your own device, CYOD.
>> There are all variations on this.
Whatever it is, we need to realize
that there is an additional threat that comes
>> from allowing systems on our network
>> that aren't controlled
>> from a corporate policy to some BYOD.
>> Another important policy, acceptable use policy, AUP's.
The purpose of an acceptable use policy
is how we allow the rules
that we place on end users in
relation to company resources.
Can you print to the company printer for personal use?
Can you make long distance phone calls
>> on the company dime?
>> They should all be
>> clarified in the acceptable use policy.
With NDA's non-disclosure agreements,
we want to make sure that
>> our employees have committed
>> in legal binding writing to not
>> disclose any company secrets.
Or that's unilateral one direction,
or the company can expose
the secrets of the employee and vice versa.
That might be in an environment
where an employee is bringing copyrighted material
>> or providing some additional expertise.
>> Multilateral means that non-disclosure agreement
implies to multiple resources within the organization.