1 1 00:00:00,457 --> 00:00:02,760 "Conduct and Use Policies." 2 2 00:00:02,760 --> 00:00:04,860 In this lesson, we're going to do a quick review 3 3 00:00:04,860 --> 00:00:07,110 of conduct and use policies. 4 4 00:00:07,110 --> 00:00:08,670 Now, this should be a very quick review 5 5 00:00:08,670 --> 00:00:09,870 because you've covered all this 6 6 00:00:09,870 --> 00:00:11,910 in your Security+ studies. 7 7 00:00:11,910 --> 00:00:13,500 When we talk about security policies, 8 8 00:00:13,500 --> 00:00:15,780 these security policies can be used to do lots 9 9 00:00:15,780 --> 00:00:17,100 of different things, and one 10 10 00:00:17,100 --> 00:00:19,980 of them is to direct the behavior of your end users, 11 11 00:00:19,980 --> 00:00:21,720 and that's really what we're going to focus on here 12 12 00:00:21,720 --> 00:00:23,940 in our conduct and use policies. 13 13 00:00:23,940 --> 00:00:26,580 Now, there are three main types of conduct and use policies 14 14 00:00:26,580 --> 00:00:27,570 we're going to cover. 15 15 00:00:27,570 --> 00:00:29,220 These include code of conduct, 16 16 00:00:29,220 --> 00:00:30,810 the privileged user agreement, 17 17 00:00:30,810 --> 00:00:32,880 and the acceptable use policy. 18 18 00:00:32,880 --> 00:00:35,490 First, let's talk about a code of conduct. 19 19 00:00:35,490 --> 00:00:38,700 Now, a code of conduct is a defined set of rules, ethics, 20 20 00:00:38,700 --> 00:00:42,210 and expectations for employees in a particular job role. 21 21 00:00:42,210 --> 00:00:45,060 So if I'm going to hire somebody as a system administrator, 22 22 00:00:45,060 --> 00:00:47,610 there's a code of conduct that should go along with that. 23 23 00:00:47,610 --> 00:00:49,500 For instance, as a system administrator 24 24 00:00:49,500 --> 00:00:52,200 I have the technical ability to log in 25 25 00:00:52,200 --> 00:00:54,690 and look at anybody's files on the network. 26 26 00:00:54,690 --> 00:00:55,920 Should I do that? 27 27 00:00:55,920 --> 00:00:56,753 Of course not. 28 28 00:00:56,753 --> 00:00:58,650 That would be against the code of conduct. 29 29 00:00:58,650 --> 00:00:59,483 Essentially, another way 30 30 00:00:59,483 --> 00:01:01,770 of saying this is it goes against my ethics. 31 31 00:01:01,770 --> 00:01:04,110 And so you might have a formal written document that says 32 32 00:01:04,110 --> 00:01:06,120 these are the things that you're going to be allowed 33 33 00:01:06,120 --> 00:01:08,010 and these are the things you're not allowed to do. 34 34 00:01:08,010 --> 00:01:09,810 And that goes into that code of conduct 35 35 00:01:09,810 --> 00:01:12,240 of telling people what their ethics should be 36 36 00:01:12,240 --> 00:01:14,010 for that particular position. 37 37 00:01:14,010 --> 00:01:15,000 Another thing we might look at 38 38 00:01:15,000 --> 00:01:16,710 is a privileged user agreement. 39 39 00:01:16,710 --> 00:01:18,600 Now, this essentially can be a contract 40 40 00:01:18,600 --> 00:01:20,370 with terms stating that a code of conduct 41 41 00:01:20,370 --> 00:01:22,650 for certain employees is assigned based 42 42 00:01:22,650 --> 00:01:23,910 on their higher level permissions 43 43 00:01:23,910 --> 00:01:25,800 on the network and data systems. 44 44 00:01:25,800 --> 00:01:27,660 As I just mentioned, as a system administrator 45 45 00:01:27,660 --> 00:01:29,160 I can log in and look at your email 46 46 00:01:29,160 --> 00:01:30,420 if you're on my network. 47 47 00:01:30,420 --> 00:01:31,500 Well, I shouldn't do that. 48 48 00:01:31,500 --> 00:01:32,760 And so we're going to have a contract 49 49 00:01:32,760 --> 00:01:35,250 with you that says you shouldn't do that, and if we find out 50 50 00:01:35,250 --> 00:01:37,590 you are doing that, we're going to fire you, right? 51 51 00:01:37,590 --> 00:01:38,730 This is a big deal. 52 52 00:01:38,730 --> 00:01:39,810 And so we want to make sure 53 53 00:01:39,810 --> 00:01:41,250 we have a privileged user agreement. 54 54 00:01:41,250 --> 00:01:42,570 This privileged user agreement 55 55 00:01:42,570 --> 00:01:45,690 is for all system administrators on a given network. 56 56 00:01:45,690 --> 00:01:46,980 Now, the other one we have is what's known 57 57 00:01:46,980 --> 00:01:49,710 as an acceptable use policy, or AUP, 58 58 00:01:49,710 --> 00:01:50,700 and this is one that's given 59 59 00:01:50,700 --> 00:01:52,620 to all the users on the network. 60 60 00:01:52,620 --> 00:01:54,780 This is a policy that governs the employee's use 61 61 00:01:54,780 --> 00:01:57,330 of company equipment and internet services. 62 62 00:01:57,330 --> 00:02:00,750 For example, what things might be in an AUP? 63 63 00:02:00,750 --> 00:02:02,940 Well, this document, which we give to all employees, 64 64 00:02:02,940 --> 00:02:04,950 is going to specify certain things. 65 65 00:02:04,950 --> 00:02:06,120 For instance, at one 66 66 00:02:06,120 --> 00:02:08,070 of the large organizations I used to work at 67 67 00:02:08,070 --> 00:02:09,120 they had things in there like, 68 68 00:02:09,120 --> 00:02:11,490 you can't go to eBay because you shouldn't be buying 69 69 00:02:11,490 --> 00:02:13,590 and selling things on company time. 70 70 00:02:13,590 --> 00:02:16,350 You shouldn't be going to porn sites, you shouldn't be going 71 71 00:02:16,350 --> 00:02:18,990 to gambling sites, you shouldn't be going to Facebook, 72 72 00:02:18,990 --> 00:02:21,930 because we want you working and not on social media all day. 73 73 00:02:21,930 --> 00:02:23,850 And so all these are different things that you can put 74 74 00:02:23,850 --> 00:02:25,230 in your acceptable use policy. 75 75 00:02:25,230 --> 00:02:27,690 Now, are these transferrable to every organization? 76 76 00:02:27,690 --> 00:02:28,830 Well, no. 77 77 00:02:28,830 --> 00:02:31,050 Some organizations are going to allow certain things. 78 78 00:02:31,050 --> 00:02:34,110 For instance, my employees are allowed to be on Facebook. 79 79 00:02:34,110 --> 00:02:34,943 Why? 80 80 00:02:34,943 --> 00:02:36,030 Because we have a study group there 81 81 00:02:36,030 --> 00:02:37,260 and we want to be able to support you. 82 82 00:02:37,260 --> 00:02:40,230 So during the day, I expect my employees to be on Facebook 83 83 00:02:40,230 --> 00:02:41,430 because I want them on Facebook 84 84 00:02:41,430 --> 00:02:42,750 so that when you put up a question, 85 85 00:02:42,750 --> 00:02:44,610 they can see it and they can help you. 86 86 00:02:44,610 --> 00:02:46,410 That's the idea of an acceptable use policy. 87 87 00:02:46,410 --> 00:02:48,990 For us, Facebook is acceptable, but I don't want them 88 88 00:02:48,990 --> 00:02:50,520 sitting there gambling all day. 89 89 00:02:50,520 --> 00:02:52,200 I want them doing their job, right? 90 90 00:02:52,200 --> 00:02:54,930 Now, on the other hand, if you work for a porn company, 91 91 00:02:54,930 --> 00:02:56,520 then looking at porn as part of your job, 92 92 00:02:56,520 --> 00:02:57,900 that might be acceptable. 93 93 00:02:57,900 --> 00:02:59,340 If you work for Google as one of the people 94 94 00:02:59,340 --> 00:03:00,990 who tries to curate what is safe search 95 95 00:03:00,990 --> 00:03:03,780 and not, you might come across a lot of porn in your job, 96 96 00:03:03,780 --> 00:03:06,060 and that's okay under your acceptable use. 97 97 00:03:06,060 --> 00:03:07,680 It just depends what your company puts 98 98 00:03:07,680 --> 00:03:10,320 as part of its values and what they want to allow. 99 99 00:03:10,320 --> 00:03:12,930 So again, there is no one-size-fits-all answer here, 100 100 00:03:12,930 --> 00:03:15,810 but on the exam, if you start seeing things that talk 101 101 00:03:15,810 --> 00:03:17,670 about what employees are and aren't allowed to do 102 102 00:03:17,670 --> 00:03:19,950 with company equipment and internet services, 103 103 00:03:19,950 --> 00:03:22,080 that is the idea of an acceptable use policy, 104 104 00:03:22,080 --> 00:03:24,130 so choose that answer and you'll do fine.