-: In the last lesson,
we discussed all the legal and regulatory requirements
that might effect your organizations.
Now there are things that you legally must follow,
and that's all those things we just talked about.
But your organization will also create a lot of policies
that they want their own employees to follow as well.
Now these aren't legally binding or required,
but they are used as part of a good,
overarching security program
by adding these administrative security controls
to your security systems.
First, we just spent a lot of time talking about
all those legal requirements to protect
your employees' and your customers'
personal and private information.
This is also going to be written up and developed
in your organization's privacy policy.
This privacy policy is going to govern
the labeling of data to ensure that all employees
understand what data they're looking at and handling
happens to be personal information.
And this will help prevent the mishandling
of confidential information.
Next, we have what's known as the AUP,
or the acceptable use policy.
An acceptable use policy is used
to define the rules and restrict how
computer, network, or other system can be used.
For example, your organization might have a policy
that states you can't use the internet
to browse pornography or gambling websites
while you're at work.
Then, based on this policy,
the security team can then monitor
user website requests at the proxy,
and if you try to access one of those sites,
they can block your access or they might
even disable your account.
The third thing we're going to
talk about is change management.
Change management is our next policy.
And change management is a structured way
of changing the state of a computer system,
network, or IT procedure.
Back when we talked about creating a
secure, known good baseline for the security of our systems,
I mentioned that we want to control the
configuration changes to be made to that secure baseline.
And that's exactly what change management does for us.
A good change management policy
is designed to make sure that you're
going to get the changes that you want
in a secure and methodical manner.
So if you decide you want to install a new application
on your workstation, you're going to have to follow
some corporate procedure to request permission
to have it installed, and then
that's going to go through the change management process
to evaluate it and approve that installation.
Because it's going to cause a change to your baseline.
Next, we have the separation of duties.
Separation of duties is a preventative
type of administrative control,
and it's one that should be considered
when you're drafting up your organizational
authentication and authorization policies.
Separation of duties is designed
to prevent fraud and abuse
by distributing various tasks and approval authorities
across a number of different users.
For example, if you work in the accounting department,
you may have access to request
a check be sent to an employee.
But you can't also approve that same request.
You would request it, and then
a supervisor would approve it.
That's a separation of duties.
This prevents fraud because now you're going to
have to have two users who are working together
to steal money from the organization
in our check approval example.
Now in the cybersecurity world,
a great example of this is when one administrator
is given the rights to create the backups on a server,
and another administrator is given the proper rights
to do the restoration of the files.
This separation of duties, backup and restore,
now goes across two different users.
Any function in your organization
that you consider high risk
should utilize a proper separation of duties.
For example, if you've ever watched a war movie
like Crimson Tide, and they're going to
try to launch a missile,
you see that two people each take out
a different physical key, insert it into the machine,
and turn it at the same time.
That is a separation of duties
because we don't want somebody accidentally on their own
launching a nuclear missile.
And so they have to have two separate keys
and two different people.
This specific type of separation of duties
is actually called dual control,
because both people have to be
present at the same time to do it.
Now another type of separation of duties
is known as split knowledge.
This occurs when two people each have
half of the knowledge of how to do something.
So for example, let's imagine I have a safe in my house
that holds my super secret family recipe
for the best macaroni and cheese you've ever tasted.
Well, I may lock it up in a safe using two different locks.
Now I know the combination to one of those locks,
but my wife knows the combination
and the location of the key for the second padlock.
Now, neither of us can open the safe by ourself,
because each of us only has half of the knowledge.
I know the combination, and she
knows where the padlock key is.
Now, only if we work together can we unlock the safe
and take out the recipe.
Now in the cyber world, we can do this using encryption.
Where a key can be broken up into two pieces,
and one is given to each of the administrators.
Now the next policy is to consider job rotation.
Job rotation is a detective type of administrative control.
And with job rotation, different users
are trained to perform the tasks of the same position
in order to help prevent and identify fraud
that could occur if one employee
had the job the entire time themself.
So basically, here we have multiple users
who learn how to do a certain job,
and then instead of one person doing it all the time,
we rotate out different people.
So again, if I go back to that check writing example,
if only one person knew how to write up the checks
and request the checks and approve the checks,
then they could have a higher chance
of stealing from the company.
But if I make that person rotate out
and have somebody else do that
job performance at some points,
they're going to have to go into the check register
and they'll be able to see
that somebody else wrote a check.
And they'll be able to see that one was missing.
And so having different employees rotate through a task
will actually allow you to catch things
that shouldn't be done.
The other good thing about this
is as your employees are going in and out
of different roles for a week or so,
they're actually going to learn new skills.
And as they learn new skills,
they're more valuable to your company.
Now the other side of job rotation
is what we call mandatory vacations.
And with mandatory vacations, we require
every employee take a vacation
at some point during the year.
Again, if they're on vacation,
it forces somebody else to come in
and do their job for them.
And when they're doing their job,
they may possibly uncover any unusual activity
such as fraud or abuse that has to be looked into.
Now besides the security benefits
of protecting against fraud and abuse,
job rotation also gives us the ability
to cross train our employees,
and develop trained personnel to back up the
primary employee in case of an emergency or vacations.
Job rotation is definitely a control
you should consider adding
inside your organizational security policies.
Another administrative control you need to consider
is what are you going to do when you hire or fire somebody.
We also call this onboarding and offboarding.
When we consider this, we're talking specifically
about information system security,
and not the human resource part of this process.
But you should consult your human resources team
whenever you're developing this part
of your security policy.
Organizations need to consider how personnel are
going to be screened and background checked for position,
how the candidates are hired and onboarded,
and then how they're going to be terminated and offboarded.
When you're screening personnel,
your organization may consider
doing a criminal background check,
a credit history, a work history,
educational background, checking your certifications
and licenses, and even giving them a drug test.
All of these various components
need to be decided upon by your human resources staff,
but are going to be incorporated into the security policy
because you're going to have to address some of those areas
such as if it's going to be pertinent
to your business model that you're going to
do a criminal background check using the IT system.
You need to understand how you're going to
collect that data and store that data securely.
Now when you hire personnel, they should be
required to sign all the appropriate documentations,
things like their employment contract,
the privacy statements, the privacy policy,
the non-disclosure agreements, and other things like that.
Then, the employee should undergo mandatory
cyber security training and processing.
And this is where the employee is
going to be given access to the network.
They're going to get their user name and their password,
their hardware security authentication token
if you're using multi-factor authentication.
All those type of things.
Now from a physical security standpoint,
we also need to ensure that new employee
has the needed building access identification.
Things like their ID badge or their pin number
to get in and out of the building.
And all of those things to make sure
they can get access into the building
and into their office.
Now when an employee is probably very cooperative
during this hiring and onboarding process
because they're excited about the new job,
they're often not as cooperative if you're firing them.
So if you're terminating somebody and it's friendly,
such as the employee decides they're
going to quit for a better job,
well then they're likely to be cooperative
and they'll turn in all their user access,
their hardware tokens, their ID badges,
and they'll even conduct an exit interview.
Now during this offboarding process,
it's important to remove their access from the network
and disable their accounts.
Now, if you have an unfriendly termination
where you fire somebody,
well that's when you're going to make sure
you want to revoke their network and
physical access to the building immediately.
Because you don't want them going and
try to steal things from your network
or put in malware into your network.
The employee should also be escorted out of the building
by security to make sure they're not taking anything
from the company such as resources, data,
laptops, hard drives, or any property that they shouldn't be
as they're being taken out of the building.
Okay, so we've covered a lot,
and I've got three more things to talk about in this lesson.
These aren't necessarily policies,
but they are concepts that you have to keep in mind
when you're writing your policies.
These are the concepts known as due diligence,
due care, and due process.
Due diligence means that you're ensuring the IT
infrastructure risks are known and managed properly.
To achieve due diligence, you need to ensure
that you conduct proper risk assessment
and conduct risk management activities
to keep operations running smoothly over time.
Due care is the mitigation actions
that an organization takes to defend itself
against risks that have been identified
during your due diligence.
So let's say I do due diligence,
and I find that our company is not utilizing
a modern operating system.
And this represents a big vulnerability.
So maybe I find they're using XP still, for instance.
Well, if I want to exercise due care,
I would allocate money to upgrade the system
from Windows XP all the way up to Windows 10.
By deciding against doing that,
and it's later found out that you were hacked
specifically because I failed to upgrade those systems,
and exercise my due care, well,
I could be held liable for damages,
and I could lose my customers.
Our third and final concept is called due process.
Due process is a legal term,
and it refers to how an organization must
respect and safeguard personnel's rights.
For example, if you're the federal government,
you can't eaves drop or wire tap on any US citizen you want.
You can't just go and say,
hey, I'm going to listen to Johnny's phone calls today.
No, this is prohibited by the
US constitution's fourth amendment,
which protects us against illegal search and seizure.
Now, if the government believes you
might be planning a terrorist attack though,
well they can go follow due process,
they can get a court ordered warrant,
and then they can tap your phone lines
to collect the information needed
to stop that terrorist attack.
Now basically, when you hear due process
in terms of the security plus exam,
I want you to think about the fact that
due process is used to protect a person from the government,
but it can also protect your organization
from frivolous lawsuits.