5.1 Explain the importance of policies, plans and procedures related to organizational security.

Question 1

Standard Operating Procedure (SOP) (aka. Procedure Policy)

Answer 1

The SOP documents step-by-step procedures showing how to configure a system or device, or step-by-step instructions on how to implement a specific security solution.

Question 2

Agreement Types

Answer 2

.

Question 3

Agreement Types - BPA

Answer 3

Blanket purchase agreement (BPA) is needed, which is used to cover repetitive needs for a product or service

Question 4

Agreement Types - SLA

Answer 4

Service level agreement (SLA) specify guaranteed uptime.

A service level agreement (SLA) is a contract, or agreement, between your organization and anyone providing services to the organization. The SLA sets the maximum amount of downtime that is allowed for assets such as Internet service and e-mail service and is an important element of the security policy.

It is important to ensure that you have an SLA in place with all providers, including Internet providers, communication link providers, and even the network service team. Should the provider not meet the SLA requirements, that could warrant looking elsewhere for the service.

It should also be noted that SLAs are used within a company between the IT department and the other departments so that the various departments have reasonable expectations regarding quality of service.

Question 5

Agreement Types - ISA

Answer 5

Ensure that you are familiar with your Internet service agreement (ISA) and ensure that you are comfortable with any data limits and the guaranteed uptime of the Internet connection. This is critical if you are taking advantage of cloud services, as you need Internet connectivity to access any services or data in the cloud.

Question 6

Agreement Types - MOU/MOA

Answer 6

A memorandum of understanding (MOU), sometimes referred to as memorandum of agreement (MOA), exists. A MOU/MOA is a document that establishes an agreement between the two parties and specifies their relationship to one another

Question 7

Personnel Management

Answer 7

.

Question 8

Personnel Management - Mandatory Vacations

Answer 8

From a security point of view, it is important to ensure that the security policy enforces mandatory vacations vacation time that must be used. The importance of taking vacation time is that it helps detect fraudulent or suspicious activities within the organization because another employee will need to take over the job role while someone is on vacation. This will help keep employees honest in their job functions because they know they will be held accountable for irregular activities discovered during their absence.

Question 9

Personnel Management - Job Rotation

Answer 9

Just as it is important to enforce mandatory vacations, your company should also employ job rotation. Job rotation ensures that different employees are performing different job roles on a regular basis. This will help detect and deter fraudulent activities within the business.

Besides from that, Job Rotation will help employees to expose them to all verticals of an organization. It is a pre-planned approach with an objective to test the employee skills and competencies in order to place him or her at the right place. In addition to it, it reduces the monotony of the job and gives them a wider experience and helps them gain more insights.

Question 10

Personnel Management - Separation of Duties

Answer 10

Separation of duties is the concept that critical job functions should be divided into multiple tasks with a different employee performing each of the different tasks.

For example, the person who writes the check cannot sign the check—this ensures that multiple persons are involved in the process to help avoid fraudulent activity by an employee.

Question 11

Personnel Management - Clean Desk

Answer 11

Many organizations implement a clean desk policy that requires users to ensure that any sensitive documents are stored away in a secure location at all times and not left in plain view on someone’s desk. It is important to stress to employees what the ramifications of not following the clean desk policy are and to be sure to perform periodic checks in the evening by walking around the office to see if anyone has left sensitive documents in plain view.

Question 12

Personnel Management - Background Checks

Answer 12

The hiring policy may specify the types of background checking that are to be performed on candidates. During this phase of the hiring process, information on the applicant’s résumé should be verified. Any indication that the candidate has lied on their résumé is a good reason not to hire the candidate. The goal of the background check is to ensure that the candidate actually has the education and job experience claimed on their résumé. The policy may also require doing criminal background checks and Google searches on the candidate.

Question 13

Personnel Management - Exit Interviews

Answer 13

A friendly termination typically involves an employee leaving the company on good terms and normally for noncompetitive reasons.

With a friendly termination, the termination policy should specify that HR host an exit interview and document the reasons for the employee leaving the company. More importantly, HR needs to remind the employee of the NDA they signed when joining the company and inform them that they still need to adhere to the agreement even though they will no longer be working for the company.

HR should be sure to collect any pass cards and keys from the employee and instruct the network team to disable their accounts after they have left the company.

Question 14

Personnel Management - Role-based Awareness Training

Answer 14

Your first major decision when designing a security training program is to identify which content is appropriate to present to the different employee roles or departments within the organization. Because security is such a critical concept and an area where you want to captivate your audience during the training and awareness seminars, you want to make sure that you keep the training relevant to the audience and based on job roles.

For example, you do not want to put the business users to sleep with complex discussions on how a firewall is implemented, so reserve technical security training for the technical team. Any members in that job role would be required to take the detailed technical training.

Question 15

Personnel Management - Role-based Awareness Training - Data Owner

Answer 15

The data owner is responsible for the data and should be trained on how to protect that data. That includes training the data owner on determining the classification label for the data, determining permissions needed, and determining if encryption should be used.

Question 16

Personnel Management - Role-based Awareness Training - Systems Administrator (Technical Team)

Answer 16

The technical team consists of the system administrators, network administrators, security administrators, and potentially the desktop support team. These individuals require training on the technical solutions that offer security, such as intrusion detection systems, firewalls, and malware protection solutions.

Question 17

Personnel Management - Role-based Awareness Training - System Owner

Answer 17

The system owner is responsible for the asset, such as the server, workstation, or device. The system owner should be trained on the value of each type of system and the types of security controls that should be used to protect the asset.

Question 18

Personnel Management - Role-based Awareness Training - User

Answer 18

Areas of security that the typical business users should be educated about are password best practices, social engineering, virus protection, and the importance of physical security.

Question 19

Personnel Management - Role-based Awareness Training - Privileged User

Answer 19

A privileged user is someone who has been assigned extra permissions to perform an administrative task. It is important to train these individuals on how to properly perform those tasks as you do not want them making configuration errors that could create a vulnerability.

Question 20

Personnel Management - Role-based Awareness Training - Executive User (Members of the Management & Executive Team)

Answer 20

You will take a totally different approach with the management team or executive user. Members of the management and executive team typically are more concerned about why things are done than how things are done.

When raising security awareness to management, focus on why they should support the security initiatives being proposed by giving them examples of past occurrences where businesses have lost huge amounts of money and/or suffered a loss of reputation due to security incidents.

Also, research whether any laws and regulations require the organization to make an effort to protect its
assets and include your findings in the training, or find and present past cases where an organization has been held legally accountable for not implementing appropriate security measures to protect its assets.

Another good idea would be to find cases where insurance companies have denied coverage based on violations of the insurance policy requirements that a company makes reasonable efforts to secure its assets. These are all examples of the type of information that would grab the attention of management in a security awareness seminar geared toward management.

Question 21

Personnel Management - NDA

Answer 21

The nondisclosure agreement should be read and signed by employees, contractors, and management personnel to acknowledge that they understand and accept that they cannot share company sensitive information that they gain access to while working at the company. The NDA applies not only while working for the company but also after the work engagement has completed.

Question 22

Personnel Management - Onboarding

Answer 22

The company should have onboarding policies defined that specify for each job role any specific training employees should have to help them in that job role. This includes onboarding for employees, management, and executives.

Question 23

Personnel Management - Continuing Education

Answer 23

Training is one of those company perks that really help boost employee morale. The company should have a continuing education policy defined that specifies each employee’s budget for training per year based on their job role.

Question 24

Personnel Management - Acceptable Use Policy/Rules of Behavior

Answer 24

As previously described, the acceptable use policy (AUP) defines the rules for how employees, management, and executives are to use technologies such as mobile devices, e-mail, the Internet, and social media.

Question 25

Personnel Management - Adverse Actions

Answer 25

With the support of the executive team, each policy should specify adverse actions for anyone who does not follow the security policies.

For example, employees should be put on notice that they could lose their job as a result of not complying with the policy.

Also, the executive team should understand that failure of the company overall to follow policies and regulations could result in being denied credit or, more importantly, being denied insurance.

Question 26

General Security Policies

Answer 26

Users should read and sign the acceptable use policy (AUP), which indicates proper usage of company assets, including computer equipment, the Internet, and e-mail.

The password policy specifies the password requirements for the organization. It contains rules regarding requirements such as the minimum length of a password, the minimum and maximum password age, password complexity, and best practices such as passwords not being shared.

The secure disposal of equipment policy is designed to ensure that employees know that they cannot donate old computer equipment without properly destroying any information or configuration on the device. The VPN policy is designed to specify under what conditions employees can gain remote access to the network through a VPN.

Question 27

General Security Policies - Social Media Networks/Applications

Answer 27

Educate employees on what information can and cannot be posted on social media. You should have strict policies in place restricting workplace photos being posted on social media because they may contain sensitive information. For example, a picture of an employee sitting at her desk might also show a sensitive document open on the screen in the background or a document on the desk.

Question 28

General Security Policies - Personal Email

Answer 28

Many employees use their personal e-mail account at work and could use this to e-mail company data outside of the company. Be sure to have DLP features in place to protect against data leaks. Also, be aware of personal cloud storage that employees may use to transfer data to and from work. You may consider blocking access to these sites on the firewall or content filtering device.