Policies and Procedures Flashcards
(36 cards)
Policies
Defines the role of security in an organisation and establishes the desired end state of the security program
They may be regulatory, advisory or informative.
Organisational Policies
Provide general direction and goals, a framework to meet business goals, and define the roles, responsibilities and terms.
System-Specific Policies
Address the security of a specific technology, application, network or computer system
Issue-Specific Policies
Built to address a specific security issue, such as email privacy, employee termination, procedures, or other specific issues.
Standards
Standards are used to implement a policy in an organisation.
E.g.: Mandatory actions, steps or rules to achieve a level of security.
Baselines
Baselines are created as reference points which are documented for use a method of comparison during an analysis conducted in the future.
E.g.: A server baseline configuration.
Guidelines
Guidelines are used to recommend actions. Guiding actions that can be broken as the situation necessitates.
E.g.: All employees get 1TB of storage for personal files on the local network.
Procedures
Detailed step-by-step instructions that are created to ensure personnel can perform a given action.
E.g.: Creating a new user.
Sensitive Data
Any information that can result in a loss of security, or a loss of advantage to a company if used by an unauthorized individual.
What are the four common “Commercial Data Classifications”?
- Public (No impact to a company if released)
- Sensitive (Might have a minimal impact if released)
- Private (Data that should only be used in the organisation)
- Confidential (Trade secrets, IP, source code and other types of data that would affect the business if disclosed).
What are the five common “Government Data Classifications”?
Unclassified
Sensitive but Unclassified
Confidential
Secret
Top Secret
What are the five common “Government Data Classifications”?
Unclassified (Can be released to the public)
Sensitive but Unclassified (Items that wouldn’t hurt national security, but could impact those whose data is contained in it)
Confidential (Seriously affect the government on disclosure,
Secret (Serious damage to national security)
Top Secret (Gravely damage national security if known to those who are not authorized to see the data)
Data Owner
A senior or executive role that has ultimate responsibility for the CIA of the asset.
The data owner is responsible for labelling the asset and ensuring that is it protected with appropriate controls.
Data Steward
A role focused on the quality of the data and associated meta data
Data Custodian
A role responsible for handling the management of the system on which the data assets are stored. (E.g.: a system administrator)
Privacy Officer
A role responsible for the oversight of any PII/SPI/PHI assets managed by the company
What is PII?
Personally Identifiable Information
A piece of data that can be used either by itself or in combination with some other data to identify a single person.
For example. Your full name, date of birth, social media user names.
Federal Privacy Act of 1974
Affects U.S. government computer systems that collects, stores, uses or disseminates personally identifiable information
What does HIPPA stand for and who does this standard affect?
Health Insurance Portability and Accountability Act
US standard that affects healthcare providers, facilities, insurance companies, and medical data clearing houses.
Who does the Sarbanes-Oxley standard affect?
Publicly traded U.S. corporations. Sarbanes-Oxley (SOX) requires certain accounting methods and financial reporting requirements.
What does GLBA stand for and for and who does this standard affect?
Gramm-Leach-Bliley Act
Affects banks, mortgage companies, loan offices, insurance companies, investment companies and credit card providers.
What is FISMA?
FISMA is the Federal Information Security Management Act of 2002.
It is a requirement that American federal agencies must comply with.
This act requires each agency to develop, document, and implement an agency-wide information systems security program to protect their data
What is PCI DSS?
PCI DSS is the Payment Card Industry Data Security Standard.
PCI-DSS is a contractual obligation that any organisations take credit card transactions must meet.
What is SB1386?
SB1386 is a Californian regulation that states organisations must inform users of a data breach.
