-: In this section of the course.
We're going to focus on policies and procedures
in all of their different forms.
Now when I discuss policies and procedures,
I'm not talking specifically about technical controls
necessarily but instead, I'm focusing a lot
on administrative controls.
Policies are one part of a larger concept
known as IT governance.
IT governance is used to provide us a comprehensive security
management framework for the organization to build upon.
We do this by using Policies, Standards, Baselines,
Guidelines, Procedures and Information classification
and even an entire lifecycle approach
to our information technology systems.
Policies are used to define the role of security inside
of an organization and it establishes the desired end state
for that security program.
This is usually provided by your senior management
and it's going to clarify the level in which
the organization is going to enforce security
and how we're going to categorize the controls
that are being applied.
Policies tend to be very broad and they provide the basic
foundation upon which the Standards, Baselines,
Guidelines and Procedures are going to be built.
Security policies are built to fill in one of three levels.
They can be Organizational, System specific
or Issue specific.
Organizational security policies are going to
provide direction and goals.
They're going to give you a framework to meet
the business goals and define the roles, responsibilities
and terms associated with it.
System specific policies are going to address the security
of a specific technology, application, network
or computer system.
These system specific policies tend to be much
more technical and they focus on protecting a certain piece
of the system or a certain piece of technology.
Finally we have Issue Specific Policies
and these are built to address a specific security issue
such as email privacy, employee termination procedures,
or other specific issues.
Now in addition to those three areas,
our policies can be further separated down into one
of three categories inside of information security.
They're regulatory, advisory or informative.
When I talk about regulatory policies,
I'm talking about things that address mandatory standards
and laws that are going to affect the organization.
Advisory policies are going to provide us guidance
on what is and what is not considered
an acceptable activity.
The most common example of this type of policy,
is known as the acceptable use policy or AUP.
And this is something that companies provide
to their employees to tell them what they can
and can't do on the network.
The third type is an Informative policy.
Now an Informative Policy is going to focus on
a certain topic and it's designed
to be educational in nature.
For example your company may wish to provide its employees
an informational policy that's going to tell them
how they should use social media outside of business hours,
so they can remain more secure.
So as we move beyond the policy, we then go into Standards.
And Standards are used to implement a policy
in an organization.
These are going to include things like mandatory actions,
steps or rules that are needed to achieve the desired level
of security.
Beyond that, we have Baselines.
And Baselines are created as reference points.
And these are used to document any kind of system
so you can later go back and compare it for later analysis.
We talked about Baselines in terms of security earlier
and we also talked about Baselines of the network.
Where you know what the network pattern is
and then you can decide if something is above
that Baseline or below that Baseline
which becomes an anomaly.
Another example of this is if you've got a brand new server.
Your team can securely configure it as much as possible
and then take a snapshot in time and call that
the Configuration Baseline.
Now this is the Baseline against which all other servers
of that particular type are going to be compared.
So if I think something bad has happened to that server
I can go back and compare what it looks like now versus
what it looked like when I installed it
and see what the differences are.
The next thing we have is a Guideline.
Now guidelines are not required actions but instead
these are the recommended ones.
Guidelines tend to be flexible in nature.
They allow for exceptions and allowances when in a unique
situation occurs.
So for example, let's say I have a guideline that every
employee gets one terabyte of storage on our cloud servers.
That might be fine for most people and if we have
secretaries or accountants or somebody who does a lot
of contract work those are fairly small files
and so one terabyte is plenty of information
and plenty of storage.
But my video editor might come up and say you know what,
one terabyte is not sufficient for me,
I need five terabytes because I'm dealing
with these large video files all the time.
Well, because it's a guideline, we can make an exception
in an allowance for that person, we could say you know what,
normally we give one terabyte but because
of your specific job role we're going to break that
and we're going to go beyond that and give you more storage
and break that guideline that we normally have.
The next thing we have is Procedures.
And Procedures are our detailed step-by-step instructions
that are created to ensure personnel can perform
a given action.
These procedures are where those high-level policies
are transferred all the way down through those standards
and guidelines into actionable steps.
For example your service desk probably has a procedure
on how to create a new user account.
And it's going to encompass all of the security related
Policies Standards and Guidelines and that will allow
your frontline employees to follow the step by step things
to create a new account and give them the right permissions
the right password strength and all
of those types of things.
Now I know that was a ton of information.
And how you develop all these Policies and Standards
and Guidelines and Procedures.
Well the good news is you don't have to start from scratch.
If you're a brand new organization a lot of this stuff
already exists if you look out to enterprise security
architecture frameworks.
Now we're not going to cover those right now,
but we are going to cover those in a separate lesson
later on in this course.
Now, further the security plus exam, the big concept
from this lesson that I want you to remember is the idea
of a policy and a procedure.
Remember that a policy is something that gives you
generic guidance to the organization.
For example, your password policy might say that
all passwords have to be long, strong, complex
and be changed every 90 days.
Then we have a procedure which is very specific.
And if I had a password procedure that might detail exactly
how to configure that password policy
on a Windows 2016 server.
Or, I might have a password procedure that's going to tell
the user how they can change their password every 90 days
by going into Windows and following steps one through five.