Security Policies

00:00

Hello, everyone. This is instructor Gerry Roberts. This is risk policies and security controls.

00:06

In this video, we're gonna talk about what security policies are. We're going to talk about what is actually in documentation for security,

00:14

how this all fits with risk management

00:17

and using a risk management framework to help us guide those policies.

00:22

First of all, what are security policies,

00:25

the security policies, air organizational policies put in place to enhance security?

00:30

So that might be something like an acceptable computer usage document that employees must sign in. And here, too,

00:36

that's a policy that tells them what they can and cannot do with their computers.

00:41

Now this could be in one document or could be spread across many documents.

00:47

Usually, these documents are living documents

00:51

edited when new risks are identified or new information is gathered.

00:55

Sometimes we find out new things about risks, and we have to change our policies and procedures. So it's always being worked on

01:03

what's actually in security documentation.

01:07

So usually, what you'll find in a document about security

01:11

are responsible parties

01:15

and sometimes a call tree. If there are more than one person responsible

01:19

security controls that are supposed to be in place

01:23

training requirements such as information awareness training.

01:27

Now some companies do that on a regular basis, such as yearly. I've heard some government places do it every six months. It just depends on the company.

01:37

Policies and procedures are also in here and those again, or things like acceptable computer usage policies.

01:44

And if there are other related documents that you might need to reference the location of those documents and the names are usually somewhere

01:53

in that document,

01:55

and those could be like your D R P or your B C P.

02:00

Now, how did they fit in with risk management

02:01

now? Security policies air one way to layout mitigation and other strategies for dealing with risk.

02:07

In our example of the computer usage documentation

02:10

we could tell users hate. You're not allowed to use specific things like, and I'll pick on Facebook because that's an easy example. But you're not allowed to go on Facebook because people keep getting viruses from Facebook games

02:23

that could be acceptable use policy.

02:27

And as part of that policy, Facebook might be blocked so users can't actually access it,

02:35

so that could be one policy.

02:38

Now again,

02:38

this helps us mitigate risk because if they don't

02:43

go visit Facebook and play the Facebook games, they're not gonna be exposed to a risk of those viruses that you sometimes get from there.

02:52

Now, most risk management plans are gonna have some sort of security policies in them.

02:58

You know, these policies air derived. Their multiple methods included the risk assessment stage, a risk management,

03:04

and sometimes they are derived from pure accidents such as the Facebook policy which happened to me at a company I worked at.

03:12

Ah, we had a social media team and they needed to access Facebook. But because Facebook was accessible to everyone, we ended up getting a bunch of viruses because people were playing games that were not sanctioned by Facebook. There were third parties

03:25

and they had issues.

03:28

So that could happen. And that could be one way you get your actual policies.

03:34

Yeah,

03:35

there's something called a risk management framework that is available to help you guide your policies and procedures.

03:40

There are several of these available, and they help you organize and help you put things together for your risk management activities.

03:50

The framer exposed to help lay the ground for your plan it access a blueprint,

03:54

some examples that you might be familiar with. NIST has several risk management frameworks. So does so

04:01

and those you confined on their website, and you can use those to help you guide your set up for your risk management.

04:11

Now, a lot of these have some steps for creating documents. What to include in some of the documents where to find resource is so these frameworks could be super useful, I was suggest definitely taking a look at them. Not all of them work for every organization, but if one is available that helps work for you,

04:30

then I would definitely suggest looking into it

04:33

and taking it into consideration. Putin put a year of documentation together.

04:39

All right, that's it for a short

04:41

lecture here. So it's time for post assessment question.

04:45

What might be in a security policy diet payment

04:48

that the responsible parties,

04:51

security controls,

04:53

trading information

04:55

or what we have all of the above in our documentation for security policies.

05:00

So I'll give you a few moments to figure that out.

05:02

You can pause if you'd like, and we'll come back to the answer,

05:09

all right. The answer is all of the above,

05:12

you might have your responsible parties in there.

05:15

Security controls air definitely usually in there,