In this section of the course,
we are going to discuss Governance.
The Governance section of the course focuses on Domain 1:
Governance, Risk, and Compliance,
specifically Objective 1.1,
which states that given a set
of organizational security requirements,
you must be able to implement
appropriate governance control.
The term governance includes the strategic oversight
and documentation necessary to maintain
and enhance an enterprise organization's security posture.
This includes not only the creation
and administration of a security program,
but also the development of awareness
and training initiatives
to ensure employees are informed and vigilant.
Furthermore, governance frameworks may be used
to align security practices
with organizational goals
while ensuring security measures are effectively implemented
and maintained across all levels of the organization.
As we go through this section,
we will cover many topics related to Governance,
including Security Program Documentation,
Awareness and Training Considerations,
Governance Frameworks,
Governance, Risk, and Compliance or GRC tools,
Management Involvement, Change in Configuration Management,
Staging Considerations, and Communication Considerations.
First, we will look at Security Program Documentation.
Security Program Documentation
includes organizational policies,
procedures, standards, and guidelines.
Policies establish high-level principles
and expectations for security.
Procedures provide detailed step-by-step instructions
for implementing policies.
Standards define specific requirements that must be met.
And guidelines offer recommended practices
to help achieve compliance
and alignment with organizational policies and standards.
Together, these documents ensure consistent
and effective security practices,
enabling secure organizational operations
by coordinating security efforts
with business objectives and regulatory requirements.
Then, we will explore Awareness
and Training Considerations.
As a part of security program management,
awareness and training considerations
include overall employee situational awareness
to include physical security,
awareness of frequent attack vectors.
such as phishing and social engineering,
and a consideration for privacy
and operational security.
These topics are a consistent mainstay in initial
and recurring security program training.
After that, we will look at governance frameworks.
Governance frameworks are used
to establish structured guidelines
and best practices for managing
and aligning IT operations with business goals
while ensuring risk management and compliance.
COBIT, the Control Objectives for Information
and Related Technologies,
is used to establish a detailed set of controls,
metrics, and processes
that align information technology management
with enterprise objectives,
ensuring effective risk management
and regulatory compliance.
ITIL, the Information Technology Infrastructure Library,
provides a structured approach to IT service management,
defining best practices for delivering
and managing services
to ensure they meet business requirements
and to optimize service delivery.
Then, we will explore Governance, Risk, and Compliance
or GRC tools.
Governance, Risk, and Compliance tools are used
to integrate the management of an organization's governance,
risk, and compliance activities
by automating processes,
tracking compliance with regulatory requirements,
and maintaining accurate documentation.
These tools often include features like mapping
to align controls with specific regulations,
automation to reduce manual workloads,
and continuous monitoring to ensure ongoing compliance
and risk management, as well as documentation.
Examples of Governance, Risk,
and Compliance tools include RSA Archer,
ServiceNow GRC, and Systems Applications
and Products or SAP GRC.
Following that, we will look at management involvement.
At the day-to-day level,
effective governance relies on management involvement
to ensure that roles
and responsibilities are clearly assigned and managed.
The Responsible, Accountable, Consulted, Informed
or RACI Matrix is a valuable tool
that can be used to clarify those roles,
detailing who is responsible for execution,
accountable for outcomes,
consulted for input, and informed of progress.
By utilizing the RACI matrix,
organizations can enhance accountability
and streamline decision-making processes,
ensuring that governance activities are effectively managed
and aligned with organizational objectives.
Then we will explore Change in Configuration Management.
Change in Configuration Management
involves structured processes
to maintain system modifications,
ensuring they are carried out efficiently,
approved, and tracked accurately.
To assist in this process,
inventory management maintains a detailed record
of all hardware and software assets,
while the Asset Management Lifecycle
addresses each stage of an asset's life,
from acquisition to disposal.
Bringing it all together,
a Configuration Management Database
or CMDB can act as a central repository
for storing information about configuration items or CIs.
Configuration Items are individual components
of the information technology infrastructure.
A Change Management Database
tracks a configuration item's relationships
to other configuration items
and to specific services.
Change Management Databases
enable effective management of changes
and the maintenance of system integrity.
After that, we will look at the Data Lifecycle.
The data lifecycle describes managing data
through its six stages of life.
The six stages of the data lifecycle are: creation, use,
sharing, storage, archival, and destruction.
Staging refers to an intermediate phase
where data is temporarily stored
and prepared for further use.
It typically occurs between the data creation
and the use phase
and serves as a space for activities like development,
testing, and quality assurance.
These activities are essential for validating
and ensuring the integrity of data
before it transitions to production
where it is fully utilized.
While staging is not one of the primary six stages
of the data lifecycle,
it plays a critical role in the preparation process,
facilitating smooth data handling
before production and eventual use.
Finally, we will explore Communication Considerations.
Communication considerations include
communication and reporting.
Effective communication and reporting are critical
to security program management
because they ensure
that relevant information about security incidents,
compliance status, and risk assessments
are accurately conveyed to internal
and external stakeholders.
Furthermore, timely and detailed reports
facilitate informed decision-making,
enable rapid response to potential threats,
and support compliance with regulatory requirements.
To finish things off,
we'll take a short quiz
to see what you learned during this section of the course,
and we will review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So let's get ready to dive into governance
in this section of the course!