© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Security Policies and Implementation Issues Lesson 5 User Domain and IT Infrastructure Security Policies

Page 2 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Learning Objective  Describe the different information systems security (ISS) policies associated with the User Domain.  Describe the different information security systems (ISS) policies associated with the IT infrastructure.

Page 3 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Key Concepts  Reasons for governing users with policies  Regular and privileged users  Acceptable use policy (AUP) and privileged-level access agreement (PAA)  Security awareness policy (SAP)  Differences between public and private User Domain policies  Elements of an infrastructure security policy  Policies associated with various domains of a typical IT infrastructure  Best practices in creating and maintaining IT policies

Page 4 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: CONCEPTS

Page 5 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Security Awareness Policy (SAP)  Addresses: Basic principles of information security Awareness of risk and threats Dealing with unexpected risk Reporting suspicious activity, incidents, and breaches Building a culture that is security and risk aware

Page 6 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Acceptable Use Policy (AUP)  Attempts to protect an organization’s computers and network  Addresses password management  Addresses software licenses  Addresses intellectual property management  Describes etiquette  Describes the level of privacy an individual should expect when using an organization’s computer or network  Describes noncompliance consequences

Page 7 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Privileged-Level Access Agreement (PAA)  Acknowledges the risk associated with elevated access in the event the credentials are breached or abused  Asks user to promise to use access only for approved organization business  Asks user to promise not to attempt to “hack” or breach security  Asks user to promise to protect any output from these credentials such as reports, logs, files, and downloads

Page 8 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Policy Organization  Requirements may cross domains − Malware protection − Password/Authentication requirements  Requirements may conflict between domains  Policies will vary among organizations  Use standard document types to identify domain security control requirements

Page 9 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Key Purpose of an IT Infrastructure Policy

Page 10 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Three Ways to Organize Policies

Page 11 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Policy Documents

Page 12 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Seven Domains of a Typical IT Infrastructure

Page 13 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Workstation Domain  Control Standards − Device management − User permissions − Align with functional responsibilities  Baseline Standards − Specific technology requirements for each device − Review standards from vendors or organizations  Procedures − Step-by-step configuration instructions  Guidelines − Acquisitions (e.g., preferred vendors) − Description of threats and countermeasures

Page 14 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved.  Control Standards − Firewalls − Denial of Service − Align with functional responsibilities  Baseline Standards − Specific technology requirements for each device − Review standards from vendors or organizations  Procedures − Step-by-step configuration  Guidelines − Acquisitions (e.g., preferred vendors) − Description of threats and countermeasures LAN Domain

Page 15 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. LAN-to-WAN Domain  Control Standards − Access control to the Internet − Traffic filtering  Baseline Standards − Specific technology requirements for perimeter devices  Procedures − Step-by-step configuration  Guidelines − DMZ, IDS/IPS, content filtering

Page 16 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved.  Control Standards − WAN management, Domain Name Services, router security, protocols, Web services  Baseline Standards − Review standards from vendors or organizations  Procedures − Step-by-step configuration of routers and firewalls − Change management  Guidelines − When and how Web services may be used − DNS management within the LAN and WAN environments WAN Domain

Page 17 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved.  Control Standards − VPN connections − Multi-factor authentication  Baseline Standards − VPN gateway options − VPN client options  Procedures − Step-by-step VPN configuration and debugging  Guidelines − Description of threats − Security of remote computing environments, such as working from home Remote Access Domain

Page 18 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved.  Control Standards − Firewalls − Denial of Service − Align with functional responsibilities  Baseline Standards − Specific technology requirements for each device − Review standards from vendors or organizations  Procedures − Step-by-step configuration  Guidelines − Acquisitions (e.g., preferred vendors) − Description of threats and countermeasures System/Application Domain

Page 19 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: PROCESS

Page 20 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Different Types of Users Within an Organization

Page 21 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Example of User Types

Page 22 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. User Access Requirements

Page 23 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Contingent and System Accounts

Page 24 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Creating Policy Documents  Documents should − Differentiate between core requirements and technological requirements − Follow a standard format − Remain relevant without constant modification − Not contain duplicate content

Page 25 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: ROLES

Page 26 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Who Develops User Policies  Chief financial officer (CFO)  Chief operations officer (COO)  Information security manager  IT manager  Marketing and sales manager  Unit manager  Materials manager  Purchasing manager  Inventory manager

Page 27 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Roles and Responsibilities: Who Need Training?

Page 28 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Roles and Responsibilities  Information Security (IS) Manager − Policy creation, application, and alignment with organizational goals  IT Auditor − Ensuring that controls are in place per policy  System/Application Administrator − Applying controls to Workstation, LAN, and LAN- to-WAN Domains

Page 29 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: CONTEXTS

Page 30 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Differences and Similarities in User Domain Policies Differences Public organizations must follow Sarbanes Oxley Compliance (SOX), Health Insurance Portability and Accountability Act (HIPAA), and other compliance laws Private organizations are often smaller and easier to control from a user standpoint Private organizations may not follow public- compliance laws

Page 31 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Differences and Similarities in User Domain Policies Similarities Private organizations may follow public- compliance laws depending on their governance requirements Public organizations may be small is size and thus have similar control over their user populations

Page 32 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: RATIONALE

Page 33 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. The User as the Weakest Link in the Security Chain

Page 34 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. The User as the Weakest Link in the Security Chain

Page 35 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Lack of Controls  With lack of controls all of the following and more are possible: Workstations would have different configurations LANs would allow unauthorized traffic WANs would have vulnerabilities Network devices would not be configured the same Users would have access to data they are not directly working with

Page 36 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Summary  Reasons for governing users with policies  Regular and privileged users  Acceptable use policy (AUP) and privileged-level access agreement (PAA)  Security awareness policy (SAP)  Differences between public and private User Domain policies  Elements of an infrastructure security policy  Policies associated with various domains of a typical IT infrastructure  Best practices in creating and maintaining IT policies

Page 37 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. OPTIONAL SLIDES

Page 38 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Roles and Responsibilities: Who Needs Training?

Page 39 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Best Practices for IT Infrastructure Security Policies

Page 40 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Best Practices for IT Infrastructure Security Policies (Continued)

Page 41 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Best Practices for IT Infrastructure Security Policies (Continued)