-: Network policies. 2 2
In this section of the course, 3 3
we're going to talk about network policies. 4 4
When we discuss policies, we're not talking specifically 5 5
about technical controls anymore 6 6
like adding access control lists to our firewalls or routers 7 7
or enabling Mac filtering or even enforcing encryption 8 8
and all the other things like that, 9 9
that we do to better secure our networks. 10 10
No, those are considered technical controls, 11 11
and they're not the only way for us to secure our networks. 12 12
In fact, there are a lot of network protections 13 13
that will come in the form of administrative controls 14 14
such as policies. 15 15
So when we talk about policies, 16 16
remember that policies are one part of a larger concept 17 17
known as IT governance. 18 18
IT governance is used to provide us 19 19
with a comprehensive security management framework 20 20
for the organization, and that way we can build upon it. 21 21
Now this is done using policies, standards, 22 22
baselines, guidelines, and procedures. 23 23
Policies are going to be used to define the role of security 24 24
inside of an organization 25 25
and establishes the desired end state 26 26
for that security program. 27 27
This is usually going to be provided by senior management 28 28
and it's going to clarify 29 29
the level in which the organization enforces security 30 30
and how the organization will categorize the controls 31 31
that are going to be applied. 32 32
Policies tend to be very broad 33 33
and they provide the basic foundation 34 34
upon which standards, baselines, guidelines, and procedures 35 35
are going to be built. 36 36
Security policies are going to be divided into three levels. 37 37
This is organizational, system-specific, and issue-specific. 38 38
Organizational security policies 39 39
are going to provide direction and goals. 40 40
They're going to give you a framework 41 41
to meet the business goals 42 42
and define the roles, responsibilities, and terms 43 43
that are associated with it. 44 44
System-specific policies are going to address the security 45 45
of a specific technology, application, network, 46 46
or computer system. 47 47
These system-specific policies 48 48
tend to be much more technical 49 49
and they focus on protecting a certain piece of the system 50 50
or a certain piece of technology. 51 51
Issue-specific policies 52 52
are built to address a specific security issue, 53 53
such as email privacy, employee termination procedures, 54 54
and other specific issues. 55 55
As we move beyond policies, 56 56
we begin to enter the world of standards. 57 57
Now, standards are used to implement a policy 58 58
within an organization. 59 59
These are going to include things like mandatory actions, 60 60
steps or rules that are needed 61 61
to achieve the desired level of security. 62 62
After standards, we have baselines. 63 63
And baselines are going to be used to create a reference point 64 64
in our network architecture and design. 65 65
These baselines are used to document any kind of system 66 66
so we can go back later and compare it for analysis 67 67
against that baseline. 68 68
For example, we may have a baseline configuration 69 69
for our network switches, 70 70
and we can compare the running configuration on any switch 71 71
to our baseline at any time 72 72
to see what changes have been made by our administrators 73 73
or a possible attacker. 74 74
Next, we have guidelines. 75 75
Guidelines are not required or mandatory actions, 76 76
but instead, they're simply recommended actions. 77 77
Guidelines tend to be flexible in nature, 78 78
and they allow exceptions and allowances 79 79
when a unique situation is going to occur. 80 80
For example, let's pretend I have a guideline 81 81
that every employee gets one terabyte of storage 82 82
on our cloud servers. 83 83
That might be fine for most of the people who work here. 84 84
Now, our salespeople, and our accountants, 85 85
and human resources, 86 86
all of those folks 87 87
would have no problem fitting all of their documents 88 88
into that one terabyte of space 89 89
because most of what they do is text files. 90 90
Those users will have lots of space here. 91 91
But my video editor, she might come up and say, 92 92
"Hey, I'm running out of space. 93 93
I need at least five terabytes of storage." 94 94
Well, based on our storage size limitations, 95 95
if they're based on a guideline, 96 96
I can make an exception to that 97 97
and allow her to have five terabytes 98 98
instead of one terabyte, 99 99
because it meets the needs of her specific job role 100 100
because she's dealing with large video files all day long. 101 101
That's the idea of a guideline. 102 102
It's something that can be changed on the fly 103 103
and an exception can be quickly made. 104 104
Next, we have procedures. 105 105
Now, procedures are detailed step-by-step instructions 106 106
that are created 107 107
to ensure personnel can perform a given task 108 108
or series of actions. 109 109
These procedures are where those high-level policies 110 110
are transferred all the way down 111 111
through those standards and guidelines into actionable steps 112 112
that can be followed by a technician. 113 113
For example, your service desk probably has a procedure 114 114
on how to create a new user account. 115 115
This procedure encompasses 116 116
all of the security-related policies, 117 117
standards and guidelines to allow your frontline employees 118 118
to be able to follow the step-by-step actions 119 119
necessary to create a new account 120 120
and give that account the proper permissions, 121 121
the correct password strength, 122 122
and all of those types of things. 123 123
For the exam, I want you to remember 124 124
all the different types of policies we have 125 125
inside of our governance as we work our way down 126 126
from the more generic to the more specific. 127 127
This includes our policies, our standards, our baselines, 128 128
our guidelines, and our procedures. 129 129
Now, in this section of the course, 130 130
we're going to focus on Domain 3: Network Operations, 131 131
specifically in Objective 3.2. 132 132
Objective 3.2 states 133 133
that you must be able to explain the purpose 134 134
of organizational documents and policies. 135 135
So let's get started talking 136 136
all about the different policies and plans and procedures, 137 137
hardening and security policies and common agreements 138 138
that you're going to find inside your enterprise networks. 139 139
(upbeat music)