Instructor: "Conduct and Use Policies." 2 2
In this lesson, we're going to do a quick review 3 3
of conduct and use policies. 4 4
Now, this should be a very quick review 5 5
because you've covered all this 6 6
in your Security+ studies. 7 7
When we talk about security policies, 8 8
these security policies can be used to do lots 9 9
of different things, and one 10 10
of them is to direct the behavior of your end users, 11 11
and that's really what we're going to focus on here 12 12
in our conduct and use policies. 13 13
Now, there are three main types of conduct and use policies 14 14
we're going to cover. 15 15
These include code of conduct, 16 16
the privileged user agreement, 17 17
and the acceptable use policy. 18 18
First, let's talk about a code of conduct. 19 19
Now, a code of conduct is a defined set of rules, ethics, 20 20
and expectations for employees in a particular job role. 21 21
So if I'm going to hire somebody as a system administrator, 22 22
there's a code of conduct that should go along with that. 23 23
For instance, as a system administrator 24 24
I have the technical ability to log in 25 25
and look at anybody's files on the network. 26 26
Should I do that? 27 27
Of course not. 28 28
That would be against the code of conduct. 29 29
Essentially, another way 30 30
of saying this is it goes against my ethics. 31 31
And so you might have a formal written document that says 32 32
these are the things that you're going to be allowed 33 33
and these are the things you're not allowed to do. 34 34
And that goes into that code of conduct 35 35
of telling people what their ethics should be 36 36
for that particular position. 37 37
Another thing we might look at 38 38
is a privileged user agreement. 39 39
Now, this essentially can be a contract 40 40
with terms stating that a code of conduct 41 41
for certain employees is assigned based 42 42
on their higher level permissions 43 43
on the network and data systems. 44 44
As I just mentioned, as a system administrator 45 45
I can log in and look at your email 46 46
if you're on my network. 47 47
Well, I shouldn't do that. 48 48
And so we're going to have a contract 49 49
with you that says you shouldn't do that, and if we find out 50 50
you are doing that, we're going to fire you, right? 51 51
This is a big deal. 52 52
And so we want to make sure 53 53
we have a privileged user agreement. 54 54
This privileged user agreement 55 55
is for all system administrators on a given network. 56 56
Now, the other one we have is what's known 57 57
as an acceptable use policy, or AUP, 58 58
and this is one that's given 59 59
to all the users on the network. 60 60
This is a policy that governs the employee's use 61 61
of company equipment and internet services. 62 62
For example, what things might be in an AUP? 63 63
Well, this document, which we give to all employees, 64 64
is going to specify certain things. 65 65
For instance, at one 66 66
of the large organizations I used to work at 67 67
they had things in there like, 68 68
you can't go to eBay because you shouldn't be buying 69 69
and selling things on company time. 70 70
You shouldn't be going to porn sites, you shouldn't be going 71 71
to gambling sites, you shouldn't be going to Facebook, 72 72
because we want you working and not on social media all day. 73 73
And so all these are different things that you can put 74 74
in your acceptable use policy. 75 75
Now, are these transferrable to every organization? 76 76
Well, no. 77 77
Some organizations are going to allow certain things. 78 78
For instance, my employees are allowed to be on Facebook. 79 79
Why? 80 80
Because we have a study group there 81 81
and we want to be able to support you. 82 82
So during the day, I expect my employees to be on Facebook 83 83
because I want them on Facebook 84 84
so that when you put up a question, 85 85
they can see it and they can help you. 86 86
That's the idea of an acceptable use policy. 87 87
For us, Facebook is acceptable, but I don't want them 88 88
sitting there gambling all day. 89 89
I want them doing their job, right? 90 90
Now, on the other hand, if you work for a porn company, 91 91
then looking at porn as part of your job, 92 92
that might be acceptable. 93 93
If you work for Google as one of the people 94 94
who tries to curate what is safe search 95 95
and not, you might come across a lot of porn in your job, 96 96
and that's okay under your acceptable use. 97 97
It just depends what your company puts 98 98
as part of its values and what they want to allow. 99 99
So again, there is no one-size-fits-all answer here, 100 100
but on the exam, if you start seeing things that talk 101 101
about what employees are and aren't allowed to do 102 102
with company equipment and internet services, 103 103
that is the idea of an acceptable use policy, 104 104
so choose that answer and you'll do fine.