5.3 Importance of policies to organizational security Flashcards
Personnel security: what is an AUP ?
Acceptable Use Policies that covers how internet, telephone, computers etc should be use
Personnel security: why an AUP is important ?
To set up a framework and limit legal liability
Personnel security: what is least privilige?
Rights and permissions should be set to the bare minimum for a user. All user accounts must be limited
Personnel security: what is a background check?
Pre-employment screening to veritfy the applicant’s claims
Personnel security: what is an NDA?
Non-Disclosure agreement is a confidential agreement to prevent the use and dissemination of confidential info
3rd party management: why 3rd party mngt is important in security?
You can get a malware via 3rd party systems
3rd party management: what should you do before engaging with a 3rd party ?
Assess the IT systems supporting the operation, evaluate the coordination between the 2 parties, document the business process changes
3rd party management: what can be included in a contract ?
- SLA
- MOU: Memorandum of Understanding = both side agree on the content
- MSA: measurement system analysis
- BPA: business partnership agreement
- NDA: confidentiality agreement
Managing data: what is data governance?
Rules, processes and accountability associated with an organization’s data
Managing data: what is data classification?
Identify data types to associate governance controls to the classification levels
Managing data: what is data retention ?
Keep files that change frequently for version control & legal requirements
Eg recover from virus infection
Credential policies: where password should be stored ?
On the server side, never on the client side
Credential policies: how password sould be communicated across the network ?
By using encryption
Credential policies: how to manage 3rd party account?
Add additional layer of security: MFA, audit the security posture of the 3rd party, don’t allow account sharing
Organizational policies: why change management is important ?
Change is one of the most common risks in the enterprise so a clear policy on how to make change must exist (upgrade software, change firewall config, modify switch port)
