>> A few additional policies to be aware of.
Usually within an organization,
there're system specific policies
and issue specific policies.
We have certain policies for web servers
that are different from domain controllers,
which are different from end-user workstations.
We may have different policies for each.
For issue specific policies,
we've talked about the need for
a change management policy and
how there has to be an orderly procedure
to request and approve changes.
We also mentioned the acceptable use policy that
dictates how employees are to use company resources.
The next thing for privacy policy,
we can certainly have policies for private information
>> of our customers and how we
>> store and protect that private information,
but we also have to think about
the privacy of our employees.
Do we have a business need to monitor email?
Do you have a business need to record phone calls?
If so, that's fine.
But one of the most important elements of
a privacy policy is ensuring that we
notify the employees if there is
going to be an infringement on policy.
People expect policy in the workplace.
I don't have to provide it,
but if that's the case and I'm
going to infringe upon policy,
folks need to be notified.
We also have to be very clear on who owns
the data and who own systems for operation.
As a general rule,
the individual or individuals that own the data
determine the classification of
the data and the protection.
Data ownership is very important and it should be
clearly defined who fulfills that role.
Also, you usually see roles of data custodian
and that individual would be
responsible for maintaining the data.
That said, the data owner
>> determines its classification.
>> Separation of duties, which is a very important policy,
make sure that we don't have conflict of interest,
and also makes sure that
no one is too powerful on the network.
I worked for a company at one point in time that had
a single network admin and
this person was really all powerful.
In all seriousness,
if somebody offended him,
he could lock those users out of
their own account and not respond for 30 minutes,
which is a tremendous abuse of power.
That really goes back to whoever signed
off on a configuration of that sort.
There should never be a single network admin.
A series of network admins
performing different activities is good.
Mandatory vacations.
I think many of us probably wish
we could get a mandatory vacation.
You'll see this in banks and
other financial institutions,
but you don't see it everywhere.
Let's say I get hired to work in a bank.
I come on board and they say,
>> "Kelly, you're going to get 10 days of paid vacation.
>> Five of those days must be taken consecutively,
>> and during those five days,
>> you may not come into the office,
contact anybody at the office,
you can't check email,
you can't remote in, you have
nothing to do with this work environment."
That way, if the bank is coming
up a couple of 100 bucks short every week,
suddenly Kelly's out of the office in
the Bahamas and the bank balances to a penny.
That might be an important detective control
and an indicator that something is going on.
Mandatory vacations are generally only present in
financial institutions and job rotation
is another detective control.
I maybe database administrator
>> database 1 for six months,
>> then move over in administrator database 2.
>> Someone else comes in behind me to database 1 and they
can detect any activity that I made up, performed,
either mistakes I've made or fraudulent activity.
Least privilege and need to know,
those two go hand-in-hand.
Least privilege and need to know
>> are very close related.
>> Principle of least privilege is usually about action.
I will allow you the only actions
that you must have to do for your job.
Need to know is about information
>> and I'm going to let you know what information
>> you need to do your job.
>> For instance, I only allow
certain users to change the system date and time.
That's the principle of least privilege.
If you're not on the sales team,
you don't get to the axis of the sales folder.
That's need to know. Very closely related.
Then we have dual control and M of N control.
Dual control is for those actions on
the network that are of such a sensitive nature.
You don't want to allow a single person
to perform that action alone.
Maybe for things like key recovery.
When we talk about security and security plus,
>> we're going to cover the very significant element of
>> a private key and how
a private key is bound to your identity.
It provides authentication for you.
If my private key gets corrupted,
they're going to be activities that I can't perform.
We need our private keys.
For that purpose, we may back up our private keys with
the idea that if it gets corrupt, we can restore it.
Problem is usually
network administrator is
relegated to that responsibility.
If my private key is mine,
but a network admin backs it up and recovers it,
now that network admin has my private key.
We might require two network admins to be present
and both enter password before a key can be recovered.
There's also M of N control,
which M and N are just variables.
Out of a total number of administrators,
>> so many have to be present.
>> 4 out of 10 network admins,
3 out of 7, doesn't matter what the numbers are.
Again, it's the idea of making sure we don't have
one single person with
too much authority or too much control.
Just wrapping up the idea of this section.
Documentation is critical,
making sure that we can rebuild
the network in the event of a disaster,
but also that at any point in time,
you can go back to our documentation
and figure out what's what.
We talked about logical versus
physical documentation that whereas physical
helps us get an understanding of how
traffic moves on the network or physical
really shows this physical devices and
where the cable is moving from point A to point B.
Our network devices and various network equipment,
those need to be labels,
configurations need to be backed up,
access control lists, the firewalls and routers,
those should be well-documented.
Racks and wiring, label, label, label,
keep them neat, keep them well organized.
Then also we make sure that we have
documentation on our policies, our procedures,
our baseline performance information so
that anyone within our organization can go to
those documents and either learn
standard operating procedures or
take the information that they need.
Policies should be published,
policies should apply to
all individuals in the workforce.
We generally look at these administrative
directive controls and in that,
management states their expectations for behavior.
We look at things like acceptable use policy,
separation of duties, dual control.
All of those policies we discussed adds
an additional important layer to
security in our environment.