Ch3 - 3.02 - General Security Policies

Question 1

Acceptable Use Policy

Answer 1

The acceptable use policy, also known as the AUP, is an important policy because it lets the users know what the company considers acceptable use of its assets such as Internet service, e-mail, laptops, and mobile devices.

Question 2

Password Policy

Answer 2

1. Minimum password length
2. Password history
3. Maximum password age
   The maximum password age specifies how long an employee is allowed to have a specific password. This value is normally set anywhere from 30 to 60 days, at which time the user must change their password.
4. Minimum password age
   The minimum password age is a minimum number of days that a user must have their password. This setting
   prevents employees from changing their password multiple times in order to get the desired password out of the history with the intent of reusing an old password.
5. Password complexity

Question 3

Nondisclosure agreement (NDA)

Answer 3

The nondisclosure agreement should be read and signed by employees, contractors, and management personnel to acknowledge that they understand and accept that they cannot share company sensitive information that they gain access to while working at the company. The NDA applies not only while working for the company but also after the work engagement has
completed.

Question 4

Service Level Agreement (SLA)

Answer 4

A service level agreement (SLA) is a contract, or agreement, between your organization and anyone providing services to the organization. The SLA sets
the maximum amount of downtime that is allowed for assets such as Internet service and e-mail service and is an important element of the security policy. It is important to ensure that you have an SLA in place with all providers, including Internet providers, communication link providers, and even the network service team. Should the provider not meet the SLA requirements, that could warrant looking elsewhere for the service.

Question 5

Security Clearance vs. Data Labels

Answer 5

The classification labels (such as secret, top secret, or even unclassified) are assigned to the information, or assets. Once all of the assets have their classification labels assigned, you can then assign employees their security clearance levels that determine which assets
they can access. For example, an employee with the security clearance of top secret can access information with a top secret label assigned to it.