Professor Messor 3.2 | Plans and Procedures & Security Policies

Change management:

Because changes—like software upgrades, firewall tweaks, or switch port modifications—are constant and pose significant risks to network uptime and availability. Despite occurring frequently it is often overlooked, leading to unexpected issues. Formal processes with clear policies help manage change, addressing factors like frequency, duration, installation procedures, and fallback plans. Without structured change control, organizations often operate chaotically, making consistent, stable changes difficult. Shifting to a disciplined approach can be challenging, but it’s essential for long-term network reliability.

Security incidents

Can range from a user unknowingly executing malware by clicking an email attachment, leading to external communication, to large-scale threats like DDoS attacks or botnet infiltrations. Sensitive data may be stolen, with threats of public exposure unless a ransom is paid. Even seemingly harmless actions, like installing peer-to-peer software, can expose internal servers to external access. Organizations must have detailed plans and procedures in place to respond effectively to these incidents.

NIST SP 800-61:

Is the Computer Security Incident Handling Guide published by the National Institute of Standards and Technology. It outlines the incident response lifecycle, which includes:

1. Preparation

2. Detection and Analysis

3. Containment, Eradication, and Recovery

4. Post-Incident Activity

While each organization may tailor its approach to handling incidents, this guide provides a foundational framework to help structure an effective incident response strategy.

Disaster recovery plan

Is essential for ensuring IT teams are prepared when disasters strike. As part of business continuity planning, the goal is to keep the organization running smoothly during and after a crisis. Disasters can range from natural events and technology failures to human-caused incidents. A comprehensive plan covers key aspects like recovery locations, data recovery methods, application restoration, and the availability of IT staff and employees.

Continuity of Operations Planning (COOP)

Ensures that a business can continue functioning during disruptions. When disasters strike, technology failures may halt normal operations. An alternative plan is crucial, such as reverting to manual processes like paper receipts or phone-based transaction approvals. These backup procedures must be thoroughly documented and tested in advance.

System life cycle

Includes managing asset disposal, particularly for devices like desktops, laptops, and mobile devices that hold company data. Proper disposal is crucial because it can be a legal issue; some data must be retained, while other sensitive information should be securely destroyed. Offsite storage may be necessary for critical data. Simply discarding devices is risky, as dumpster diving is a real threat. Additionally, recycling must be done.

Standard operating procedures (SOPs)

Are essential for guiding an organization’s day-to-day operations. They cover processes like downtime notifications, handling facilities issues, software upgrades, testing, and change control. Clear documentation is crucial so that everyone can review and understand these procedures, ensuring consistency and alignment with business objectives.

Common agreement

It is essential to set clear expectations for service levels. A Service Level Agreement (SLA) specifies minimum terms like uptime and response times, typically used between customers and service providers. SLAs are formal documents that are legally binding and signed by both parties.

In contrast, a Memorandum of Understanding (MOU) outlines agreed-upon terms and often includes confidentiality statements. However, an MOU is informal and acts as a letter of intent rather than a signed contract.

Non-Disclosure Agreement (NDA)

Is a formal contract ensuring that confidential information remains protected, with penalties for unauthorized disclosure. It safeguards sensitive data like trade secrets, business activities, or any specifics outlined in the agreement.

Can be unilateral, where only one party must keep information confidential, or bilateral/multilateral, where all involved parties are bound by confidentiality.

These agreements typically require signatures from all parties.

Password policy

Is crucial for keeping attackers out of systems. It emphasizes creating passwords with high entropy, meaning they are unpredictable and resistant to guessing or brute-force attacks. Avoid single words, obvious choices like pet names, and common substitutions (like replacing "o" with "0"). Instead, use a mix of uppercase and lowercase letters, special characters, and consider using passphrases or sets of unrelated words. Passwords should be at least 8 characters long. Additionally, prevent password reuse by having the system remember password history and enforce unique passwords.

Acceptable Use Policies (AUP)

Define what is considered acceptable use of company assets. These policies are usually detailed in documents like the Rules of Behavior or the employee handbook. They cover a range of topics, including internet use, telephone and computer use, and mobile devices.

Help organizations limit legal liability by clearly outlining acceptable behaviors and practices. If an employee is dismissed, this provides documented reasons that justify the action.

BYOD (Bring Your Own Device)

Refers to employees using their personal devices for work purposes. While the employee owns the device, it must comply with company requirements. Securing these devices can be challenging because they serve both personal and professional functions. Key concerns include data protection and what happens to the data when a device is sold or traded in. To address these issues, organizations often use a Mobile Device Manager (MDM) to enforce security policies and manage devices effectively.

Remote Access Policies

Are essential as more employees work outside the office. While internal communication is easier to manage, remote access introduces complexities. These policies outline security methods required for accessing the network remotely, including guidelines for third-party access. They specify technical requirements such as the type of encrypted connections, the protection of confidential credentials, and the necessary hardware and software.

On-boarding

Involves integrating new hires or transfers into the organization. This process includes having new employees sign IT agreements, which may be part of the employee handbook or a separate Acceptable Use Policy (AUP). During on-boarding, accounts are created, and users are assigned to the appropriate groups and departments. Necessary IT hardware, such as laptops or tablets, is provided, preconfigured, and ready for use. Typically, is a well-documented and established process to ensure a smooth transition for new employees.

Off-boarding

Is the process of managing an employee's departure from the organization. It should be pre-planned with documented procedures to ensure consistency and security. Key aspects include handling the return of hardware, managing data, and deactivating (but not always deleting) account information. Well-documented and detailed.

Data Loss Prevention (DLP)

Systems are designed to identify and block sensitive data from being transferred across the network. This includes protecting information such as social security numbers, credit card details, and medical records. Requires detailed policies to define what data is considered sensitive and how it should be handled. It monitors how sensitive data is transferred, ensuring that it is encrypted when necessary and blocking data sent unencrypted. Solutions often involve multiple implementations, such as server-based solutions that monitor files and firewall-based solutions that inspect network traffic. These measures help prevent sensitive data from reaching unauthorized parties.

Security policy

Documents an organization's IT security processes and procedures. It covers various aspects, such as on-boarding, remote access, and other critical security measures, tailored to the organization’s specific needs and focus. Since IT environments are dynamic, is not a static document; it must be updated regularly to reflect changes and ensure ongoing protection against evolving threats.