I have to admit it but I have a real aversion to paper.
I can work on computers and networks all day long.
But the moment you start making me fill in forms and checklists and meetings and all that stuff I start
to collapse pretty fast anyway.
With that in mind.
Guess what.
Security plus is full of different types of security policies.
Now there are hundreds and hundreds I mean literally hundreds of different types of security policies
out there.
But luckily for us security plus only covers in detail a very few of them and this episode my friends
we're going to pound every one of them out.
So let's go ahead and get started and take a look at a number of important security policies you're
going to see on security.
Plus first is the famous acceptable use policy the Acceptable Use Policy is the most well known simply
because just about everybody who gets on is a new hire with a company usually has to sign this and acceptable
use policy defines what a person can and cannot do on company assets.
Now when we talk about I.T. security what we're really talking about is what can you do on the computers
and on the Internet that you're accessing through the company.
So an acceptable use policy is going to be covering things like personal use of the computer.
It's going to talk about you know you can't look at pornography you can't be buying and selling things
on eBay during company hours.
It's going to define where you get to store stuff and where you can't store stuff.
The problem with acceptable use policies is that nobody can predict all the things that we don't want
you to do.
So they tend to use very broad strokes as a policy should to make sure you're being a good little employee.
Next our data sensitivity and classification policies data sensitivity and classification just means
you have to define how important different types of data are.
So within an organization we can classify this data by applying labels to it in the big federal government.
You'll see things like top secret and stuff like that.
But even in the private sector we'll see stuff like that is highly confidential.
A lot of organizations will generate their own gradation of classification of data sensitivity and at
least gives people an idea of how important different types of data are and what we are to do with them
next.
Our access control policies and access control policy defines how people get access to our data and
other resources.
So when we're talking about an access control policy that can actually cover a lot of different stuff
for example it will it could define how do you use passwords or Bob's or smart cards or whatever you
might want to use for authentication.
It can define based on the type of job you have what type of access to what type of classify data you
have access to.
It can define based on your job title what you can and cannot do so an access control policy tends to
be a fairly big document.
In fact even though it's a big document a lot of times access control policies will be incorporated
into things like Acceptable Use Policies data classification policies.
There's no fixed rule that says you have to have each and every one of these policies but I assure you
this you will have a policy on access control.
Next is a password policy a password policy defines how you deal with passwords.
Now a password policy is another one those policies that can often get snuck into different policies
so it's not real common to see a password policy is its own standing document.
Now the thing about password policies is that it's easy to remember stuff like that.
We need to use long and complex passwords.
But a good password policy will cover more than that it will cover things like for example if someone
loses their password.
How do we go about getting it back.
If someone logs in wrong too many times how do we deal with that if we have a password change requirement
as part of this.
Can they use a password that they use two times before so a password policy covers more than just the
length and the complexity of passwords.
Because I know there's a lot to passwords.
The next type of policy is care and use of equipment.
So without even telling you anything if you're reading this you might be going Gee care and use of equipment
wouldn't that be kind of under acceptable use policy.
Well yeah and also no.
First of all you can't put this policy as part of acceptable use.
But when we talk about care of equipment what we're really talking about is not so much the data and
what you're doing with the equipment but how you maintain the equipment how you borrow the equipment
if you're given different pieces of equipment and you're issued a phone or anything like that.
What are your responsibilities for it what do you do if it's broken.
All of those things that underneath this particular policy next are privacy policy ease privacy policies
are kind of interesting because up to this point pretty much every policy that we've talked about is
kind of an in-house policy what do we do with just us.
But privacy policies can actually be applied for the first time to customers as well as just in-house.
Now you can still have privacy policies in-house but they tend to be kind of boring.
In-house privacy policies basically tell the employees everything you do on the computers here in the
office we can look at we can snoop on we can do whatever we want to do.
Where it gets interesting is when we have privacy policies that are applied to our customer base and
probably the best example of this are the many many different types of web apps we have out there.
Facebook of course eBay Google and whenever you use these or at least the first time you do there really
is a policy that you have to agree to in order to use Google or Facebook or eBay or whatever it is and
they say in these policies what they're going to do with your privacy.
For example Facebook probably the most famous of privacy policy questionable antics says things like
we can use your photographs wherever we want you.
I know there's adjustments but you need to read this stuff to understand what your privacy can and can't
do.
Google clearly says we will use your data to give you customized advertisement.
Basically they're reading all your stuff they're reading your Google Docs and they're reading your e-mail
and they're using this stuff to put up different ads which essence it's Google.
What are you going to do.
I don't know about you guys but when it comes to privacy policies in-house Well there's not much I can
do about it.
But when it comes to dealing with these different types of Web Apps I read every single lie the last
type of policy I want to talk about are personnel policies a personnel policy has to deal with the people
that are dealing with our data.
So what do you do with people well for example one of the things you might want to do is if this is
really important information you might want to do some background checks or if this is military you
might want to do some kind of security clearances.
And this is where we start dealing with that stuff.
That's the job of the personnel policy personnel policies don't stop there though.
For example they might handle things like we will use job rotation we will have mandatory vacations.
If it has to do with a person and it has to do with a person who's dealing with data it goes under personnel
policy.
Yipe That's a lot of different policies and folks I hate to tell you this but you got to memorize every
single one of these because security plus goes nuts about what type of policy would be discussing not
least privilege and what type of policy would be handling different levels of classification of data.
And they will hit you on this.
So you've got to take some time if there's going to be one episode you'll probably watch a few times
it's going to be this one.
Make sure you know all of these different policies and all the detail thus described in
an
open.