In this lesson,
we're going to talk about Security Program Documentation.
Security Program Documentation outlines
an organization's fundamental approach
to managing and protecting its information systems
from security threats.
Security Program Documentation
includes administrative controls
such as organizational policies, procedures,
standards, and guidelines.
Administrative controls are designed
to regulate the behavior of employees
and ensure adherence to security and operational standards.
Administrative controls further focus on managing human
and operational risks.
Policies, procedures, standards, and guidelines
are all considered administrative controls
and are essential to an organization
because they provide a clear framework
for consistent decision making
and best practices to meet regulatory requirements.
To better understand policies, procedures,
standards, and guidelines, we are going to use the analogy
of driving a car throughout this lesson.
First, let's discuss policies.
Policies establish high-level principles
and expectations for security.
They define what is allowed and what behavior is expected.
Individuals are required to follow policies
and there are often consequences for not following them.
When driving a car, policies tell us which side of the road
to drive on, how fast we can legally drive,
and that we have to stop at red lights.
They also tell us who has the right of way
at an intersection.
Violating any of these policies will get you a ticket.
Examples of security policies include separation of duties,
job rotation, and mandatory vacation.
Separation of duties helps prevent fraud
by ensuring no single person has control
over all aspects of a process.
For instance, in accounting, one person cannot both request
and approve a payment.
In cybersecurity, one administrator might manage backups
while another handles restoration.
A variant of separation of duties is split knowledge.
In split knowledge,
two individuals each hold half of the information needed
for a task.
Split knowledge also includes breaking a cryptographic key
into two parts and assigning each part of the key
to different administrators.
Next, job rotation involves training multiple employees
to perform the same tasks.
This helps to identify fraud
and provides backup in emergencies.
Job rotation also allows cross training
to enhance organizational resilience.
Finally, mandatory vacation policies
require employees to take time off.
During mandatory vacations, their job duties
are temporarily assigned to others.
This can help uncover any suspicious activity such as fraud,
while providing cross-training opportunities
and backup for critical positions.
The key benefit of policies
is that they establish clear,
mandatory principles and expectations,
ensuring consistent behavior and decision making
across an organization.
This is just like having a speed limit
that helps us ensure safety on the road.
Second, let's discuss procedures.
Procedures provide detailed, step-by-step instructions
for implementing policies and are required to be followed.
When driving, procedures tell us
how to reach our destination
through detailed driving directions.
For example, take a right at the stoplight on Main Street.
The steps for handling an incident response
are an example of a security procedure.
Procedural steps in an incident response may include
notifying the incident response team,
documenting the details of the breach,
and following a specific communication plan
to inform relevant stakeholders.
For instance, in the event of a security breach,
the incident response procedure dictates
the exact sequence of actions an employee must take,
from isolating the affected systems
to contacting the appropriate authorities.
In this case, the procedure ensures that nothing is missed
during a critical moment.
Similarly, in a backup and recovery scenario,
the procedure outlines the exact steps
for performing regular data backups
and restoring those backups.
This ensures consistency and accuracy.
The key benefit of procedures
is that they eliminate ambiguity,
providing clear instructions
that reduce the likelihood of errors or misinterpretation.
Third, let's discuss standards.
Standards define specific requirements that should be met.
However, standards don't have the enforcement
that laws and regulations do.
Instead, they're created for specific industries
to be followed as a best practice.
Some standards though,
do have penalties associated with noncompliance,
and that makes them extremely important to follow.
For example, the standard stop sign in many countries
is a red octagon that has the word "stop"
in capital letters on it.
This uniform and consistent sign
helps drivers to know they need to stop their cars
at an intersection even if they're driving
in a foreign country.
Although having red stop signs isn't an international law,
using this guidance makes it likely
that drivers will recognize the sign
and stop at the appropriate time.
Examples of security standards include
the Payment Card Industry Data Security Standard,
or PCI-DSS,
the International Organization for Standardization, or ISO,
the Capability Maturity Model Integration, or CMMI
and the National Institute of Standards and Technology,
or NIST.
The Payment Card Industry Data Security Standard
is a contractual agreement that any organization
handling credit card information must follow.
While not a law, compliance is mandatory for organizations
that collect, store or process credit card data.
Failure to comply can result in losing the ability
to process credit card transactions,
which could cripple an e-commerce business.
In contrast, other standard bearers,
such as the International Organization for Standardization,
the Capability Maturity Model Integration
and the National Institute of Standards and Technology
provide best practices
rather than strict compliance requirements.
The International Organization for Standardization
provides a series of standards for industries,
including information security.
For instance, the "ISO 27000" series
focuses on information system security management,
with over 60 standards covering different aspects
of an organization's IT network, policies and its controls.
Next, the Capability Maturity Model Integration
is a process improvement model
used in the development of software, products and services.
It assesses an organization's maturity level,
defining levels that range from one to five,
with higher levels indicating more refined
and optimized processes.
Government contracts often require
a specific maturity level, such as three, four,
or five to be met depending upon
the complexity of the network.
Finally, the National Institute of Standards and Technology
provides over 1,300 standards for industries.
In information security, the "NIST 800" series
is a particularly important one.
For example,
the "National Institute of Standards and Technology
Special Publication 800-53"
outlines security and privacy controls
for federal information systems, offering over 800 controls
across 18 areas for risk management.
The NIST standards, though not legally binding,
are critical for ensuring security
and operational efficiency in various sectors.
The key benefit of standards
is that they provide clear, uniform requirements
and best practices, ensuring consistency, quality,
and compliance across an industry or organization.
Fourth, let's discuss guidelines.
Guidelines offer recommended best practices
to help achieve compliance and alignment
with organizational policies and standards.
You aren't required to follow guidelines.
Using our driving analogy,
guidelines include a map application such as Google Maps.
Helpful journey guideline tips may include routes
to avoid congested traffic and scenic locations for breaks.
Although guidelines offer advice to improve your journey,
you aren't required to follow them.
Examples of security guidelines
include recommendations for configuring firewall rules
to enhance network security,
or suggested encryption protocols
for securing sensitive data.
While these are not mandatory,
following them helps strengthen the security posture
and align with industry best practices.
Password management is also a guideline.
It might suggest using multifactor authentication
and implementing password complexity rules,
even if an organizational policy
doesn't mandate these measures.
These recommendations help employees make informed decisions
and adopt more secure practices voluntarily.
The key benefit of guidelines is their flexibility,
allowing organizations to tailor best practices
to their specific needs without the strictness
of policies or procedures.
So remember, Security Program Documentation
outlines how organizations manage and protect
information systems from security threats.
It includes administrative controls such as policies,
procedures, standards, and guidelines.
These regulate employee behavior and manage human
and operational risks.
Policies establish required principles
while procedures provide detailed mandatory steps
for implementing policies.
Next, standards define best practices
and compliance requirements and include
the Payment Card Industry Data Security Standard,
and the "International Organization for Standardization
27000" series.
This ensures consistency and security.
Finally, guidelines offer recommended,
flexible best practices to help organizations align
with policies and standards.
Together all these components form a framework
for decision making, security and compliance,
ensuring that security programs follow best practices
and regulatory requirements.