Week 4 Flashcards
What is cyber security policy?
The codification of cyber security objectives to support desired behaviour to achieve said objectives. They present security goals. Not implementations or a detailed set of instructions/procedures.
- It’s a very powerful tool
- instructions from management that indicate the expected governance of that organisation.
- Comprises of not only general directives but also goals, objectives, beliefs and responsibilities.
- Represents areas of focus for management.
What is China’s internet policy versus the EU’s internet policy?
“The internet is to serve the objectives of the state” - China.
“The internet should be open and accessible to all” - EU.
The EU’s policy implies we need to continue expanding the internet so that it reaches everyone. Good for collecting more info.
What policy will support superior national security (EU or China)? Recall two points of view from NYT and British Tories.
Two points of view:
1) NY Times video:
China’s internet is more like an intranet.
They’ve gotten so advanced that Western Apps are copying them. Specifically WeChat - large variety on one app. The gov are able to monitor literally everything. Combines FB, Amazon, Tinder, Venmo, Robinhood etc etc.
Problem: Gov and companies can track every single movement you make.
2) British Tories video.
What is involved in the creation of policies ?
- we have lots of concerns and ideas to begin with.
- we look at these and turn these into properly assessed risks. Determine the consequences of these happening and the likelihood.
- Take some of these risks and introduce a treatment (policy).
What is the “hierarchy of Governance” pyramid?
1) Top level of pyramid: Policies - High level objectives of the organisation and directives to mitigate and minimise risks. The “What”.
2) Middle level of pyramid: Standard - meet the objectives and directives of the policy. How to achieve these directives. The “How”.
3) Bottom of pyramid: Procedures - explicit instructions on how to achieve these.
What are the motivations for policy?
- consistency: reduces inconsistent behaviour. Be careful though because reducing autonomy of employees can upset them.
- controls and products - the security product has to be deployed in adherence with the context, i.e. via the policy so that the whole organisation adopts this approach.
- distribution of knowledge - e.g. communicate don’t share passwords with others. Effective communication.
- expectations - creating that foundation for disciplinary actions.
- compliance and audit
- avoiding liability - shows the org have at least thought about security. Minimise threats of litigation.
- tone - sets the tone for security within the org that employees will display in their day to day.
- management endorsement
What language should you use in the policy?
- Should be a general solution for addressing a problem, not the implementation
- Short and simple directions
- Clear language such as “must”, “do”, “will”
- Limited sentences and/or bullet points
- Clear and not vague.
- Realistic in the expectation of what they want in terms of desired behaviours.
- Must operate within the legal and reg environment
- Should not prohibit that they can not enforce
- Must not be designed in such a way that makes them difficult or unrealistic to follow
- Inclusive versus exclusive policies: inclusive states what is permitted, exclusive states what is prohibited.
What might you see in a policy document?
- Directives/objectives of the policy.
- Revision control: states the version number of the policy, what’s the effective date of the policy. Allows employees to see what they need to update. Useful for employees to contrast the latest version with the last version.
- Revision detail: useful to include a brief summary of what’s actually changed.
- Owner: who owns and improves a particular policy. Indicates who should receive feedback on the policy.
- Roles and responsibilities: who is responsible for implementing/monitoring aspects of the policy. Important in the real world.
- Executive sign off - signifies that this policy has been endorsed by the upper levels.
- Purpose: what the policy doc aims to cover.
- Scope: who the policy doc applies to. There could be that a policy only applies to a certain section of the enterprise.
- Related documents: e.g. reg compliance info
What are the policy topics covered by policy?
Companies might just have a single policy when it comes to cyber security. They might also have multiple policies.
No wrong answer. At a minimum, the org wants to show it’s being properly governed. Some examples:
Email policy, Data Breach Response Policy, Internet Usage Policy, Workstation Security Policy (for HIPAA) - informed by specific domain guidance for the healthcare sector.
what is a “Baseline Policy”?
Other policies build upon this and use it as a foundation. Allows flexibility for other policies.
Why would an organisation have a data breach response policy?
Communicates to the outside world that you’re aware of data breaches. An example of this is GDPR.
What is policy verification and validation?
Metrics can be used to determine whether or not security objectives are being met.
what are the problems with policies?
- Having many policies could lead to confusion and lack of clarity.
- Policies may curb autonomy. Could result in disgruntled employees
- Policies may curb and impact on business objectives- they may curb employees from doing their job.
- Focus on policies is often on risk rather than how people make decisions and what motivates them.
What is the “Shampoo algorithm”?
Lather, rise, repeat.
Get clean in a security context. We want to break out of this, where we are continually performing the same actions but not sure if we’re ever getting clean.
How do we quantify risk?
We have to understand the value of the underlying asset that’s at risk.
Reaching a consensus on a single question can be very challenging.
