-: Hardening and security policies. 2 2
In this video, we're going to talk about 3 3
the various hardening and security policies 4 4
that are used in securing your enterprise networks. 5 5
This includes password policies, acceptable use policies, 6 6
bring your own device policies, remote access policies, 7 7
onboarding and off-boarding policies, security policies, 8 8
and data loss prevention policies. 9 9
First, we have password policies. 10 10
Now a password policy is a set of rules created 11 11
to improve computer security by motivating users 12 12
to create dependable, secure passwords, 13 13
and then store and utilize them properly. 14 14
This document will promote strong passwords 15 15
by specifying a minimum password length, 16 16
a complexity requirement requiring periodic password changes 17 17
and placing limits on the reuse of passwords. 18 18
Once you create your password policy, 19 19
it's important to educate your end users on the requirements 20 20
that are set forth in this policy. 21 21
Also, you want to create guidelines and standards 22 22
within your organization based on your password policy 23 23
and use those to implement the technical controls 24 24
that will enforce the requirements set forth 25 25
in your password policy. 26 26
Next, we have acceptable use policies. 27 27
An acceptable use policy or AUP 28 28
is a set of rules applied by the owner, creator 29 29
or administrator of a network website or service 30 30
that restricts the ways in which the network website 31 31
or system may be used and sets guidelines 32 32
as to how it should be used. 33 33
Now, essentially, this is a policy that governs 34 34
the use of the company equipment and its internet services 35 35
by its employees. 36 36
So what kind of things might you find in an AUP? 37 37
Well, this is really going to depend on your organization 38 38
and its requirements. 39 39
At one of the large organizations I used to work for, 40 40
they had restrictions that prevented employees 41 41
from accessing websites like eBay, 42 42
because you shouldn't be buying and selling things 43 43
while you're at work. 44 44
They also prevented employees from accessing pornography 45 45
or gambling websites. 46 46
Another organization I worked at restricted, 47 47
the use of Facebook while at work, 48 48
because they didn't want people spending their time 49 49
on social media during the workday. 50 50
But like I said, 51 51
this is really going to depend on your organization. 52 52
In my company, I don't block Facebook 53 53
because I want my team members there 54 54
because I want them to be in our Facebook group 55 55
and interacting with our students 56 56
in the Dion training Facebook group. 57 57
As you can see, there's really no one size 58 58
fits all answer here, 59 59
but for the exam, if you start seeing things 60 60
that talk about what things an employee can and cannot do, 61 61
what they're allowed to do with company equipment 62 62
and internet services, 63 63
your correct answer should be unacceptable use policy 64 64
or AUP. 65 65
Next we have bring your own device policies. 66 66
Bring your own device or BYOD is going to allow, 67 67
or sometimes encourage employees to access enterprise 68 68
networks and systems using personal mobile devices, 69 69
such as smartphones, tablets, and laptops. 70 70
Some organizations are fully embracing a culture 71 71
of bringing your own device 72 72
while others have rejected it completely 73 73
because it does bring up different security risks 74 74
that you have to think about. 75 75
After all, let's say I'm able to bring my laptop to work 76 76
and connect it to your network. 77 77
Now, any malware issues I have on my device 78 78
are now going to be a part of your network too, 79 79
and it can spread. 80 80
BYOD also has a lot of challenges with maintaining 81 81
a proper configuration baseline too, 82 82
because the company doesn't technically own that device 83 83
and therefore they can't patch them or upgrade them 84 84
automatically using their patch management processes 85 85
because the employee owns that device. 86 86
Now, on the other hand, 87 87
a lot of companies really love BYOD 88 88
and this bring your own device policy because it means 89 89
they don't have to buy you a laptop or a cell phone 90 90
or a tablet because you as an employee are simply going to 91 91
bring your own personal device and do your work on it. 92 92
This will save the company money in the short term, 93 93
but again, there's a lot of security concerns here 94 94
you have to worry about. 95 95
When the data goes onto that device, 96 96
whose data is it? 97 97
Is it the company's data or is it the employee's data? 98 98
Who has the rights to it? 99 99
Where do you draw the line between what personal data 100 100
can be on that laptop and what is going to be business data 101 101
that has to be properly secured. 102 102
These are all things you have to think about, right? 103 103
If there's going to be an incident, 104 104
can the company take your personal devices as evidence 105 105
during the investigation? 106 106
Can they require you to reformat and purge 107 107
all your information from your smartphone, 108 108
including all the pictures of your kids? 109 109
That is something you have to think about. 110 110
As you can see, there are a lot of questions 111 111
that come up when you start using a bring your own device 112 112
or BYOD policy. 113 113
In general, I recommend against using a BYOB policy 114 114
in enterprise networks. 115 115
But if you are going to embrace a BYOD policy, 116 116
then I suggest you create a segmented network 117 117
where your BYOD devices can connect directly to the internet 118 118
and then use cloud hosted resources, 119 119
instead of going into your local network directly. 120 120
Next, we have remote access policies. 121 121
Now a remote access policy is a document that outlines 122 122
and defines acceptable methods of remotely connecting 123 123
to the internal network. 124 124
For example, are your employees allowed to be connected 125 125
to internal network resources such as your email server 126 126
directly over the internet? 127 127
Now, in most cases, 128 128
you're not going to configure your email server 129 129
to allow this to happen because it opens you up 130 130
to a whole bunch of vulnerabilities. 131 131
Instead, you may choose to enable a web mail server 132 132
that sits in a screen sub-net or a DMZ, 133 133
and then allow your employees to connect to that, 134 134
and it will be used essentially as a jump box 135 135
into the exchange server. 136 136
Or your remote access policy might decide that you're going to 137 137
allow employees to use their corporate laptops, 138 138
to connect to the internet over a VPN connection. 139 139
This way, they're going to be connecting to your network, 140 140
using a trusted device, that corporate laptop using your 141 141
standard baseline configuration security protocols, 142 142
and they can validate their identity using whatever 143 143
authentication and authorization procedures 144 144
you have to ensure the security of your network. 145 145
This again goes into your remote access policy. 146 146
What type of services, whether they're VPNs or other things, 147 147
are you going to allow your employees to use? 148 148
Again, as you start creating your remote access policy, 149 149
it's really going to be based on your risk tolerance 150 150
and your operational needs, 151 151
and it is going to be dependent on your organization. 152 152
Next, we have onboarding and offboarding policies. 153 153
Now an onboarding policy is a documented policy 154 154
that describes all the requirements 155 155
for integrating a new employee into the company 156 156
and its cultures, as well as getting 157 157
that new hire all the tools and information they need 158 158
to be able to do their job successfully. 159 159
Now, an offboarding policy is a documented policy 160 160
that covers all the steps necessary 161 161
to successfully part ways with an employee 162 162
following their resignation or termination. 163 163
When you do this well, a clear off-boarding process 164 164
will ensure a smooth transition for both your company 165 165
and the departing employee. 166 166
Now a good onboarding and offboarding policy needs to extend 167 167
beyond the information technology realm. 168 168
But for our purposes, we're focusing really 169 169
on the IT side of things. 170 170
For example, when somebody is hired, 171 171
how is that new employee going to get their account created? 172 172
How are they going to be issued a new laptop 173 173
or smartphone or tablet? 174 174
How are they going to be given access 175 175
to different network resources 176 176
like the company shared drive? 177 177
All of these are things that need to be documented 178 178
within the onboarding policy and it's associated procedures. 179 179
On the other hand, 180 180
when an employee resigns or is terminated, 181 181
how are you going to remove them from all their accounts 182 182
and accesses? 183 183
How long do they have before their accounts can be deleted 184 184
once they transfer? 185 185
Do you need to archive their data for historical purposes 186 186
and record-keeping, or can you delete it all? 187 187
Do you need to take back equipment like a laptop 188 188
or a smartphone or a tablet? 189 189
How are you going to refurbish it so it's ready to be issued 190 190
to the next employee who's hired into that position? 191 191
All of these are things you need to cover 192 192
inside your offboarding policy. 193 193
Next, we have security policies. 194 194
Now a security policy is a document that outlines 195 195
how to protect the organization systems, 196 196
networks and data from threats, 197 197
including computer security threats, 198 198
and how to handle situations when they do occur. 199 199
A security policy is going to identify 200 200
all of a company's assets as well as the potential threats 201 201
to those assets. 202 202
Now, in many organizations 203 203
there may be a single overarching security policy, 204 204
that's going to contain all the other security policies 205 205
underneath it. 206 206
Things like the AUP, the BYOD, 207 207
the password policy, the onboarding policy, 208 208
the offboarding policy and many others. 209 209
In other organizations, they prefer to break apart 210 210
the larger security policy 211 211
into smaller individual policies 212 212
for use within the organization. 213 213
Finally, we have our data loss prevention policy. 214 214
Now a data loss prevention policy is a document 215 215
that defines how organizations can share and protect data. 216 216
It's going to guide how data can be used in decision-making 217 217
without it being exposed to anyone 218 218
who should not have access to it. 219 219
Now, the goal of a data loss prevention policy 220 220
is to minimize accidental or malicious data loss. 221 221
These policies need to cover the entire network, 222 222
not just your file servers or your email servers. 223 223
In my organization, 224 224
we use a data loss prevention system 225 225
based on our organizational DLP policies. 226 226
Our DLP system goes through our network 227 227
and inspects any data being sent or received. 228 228
For example, if our system detects that 229 229
a large amount of data is being sent out of our network 230 230
to a site like Google drive or Dropbox, 231 231
it can create an alert and tell our system administrators 232 232
that we need to investigate that. 233 233
This way we can look at, what particular employee 234 234
was sending, what particular documents 235 235
and decide is that legitimate or not. 236 236
In some cases, an employee might need to send 237 237
a large amount of data, but in others they shouldn't 238 238
be sending large data files. 239 239
And that may be them trynna steal data from our systems. 240 240
For example, 241 241
let's say that my DLP system created an alert 242 242
because one of my employees was uploading 243 243
all the video content from this course 244 244
into one of our video servers 245 245
or to one of our video distribution partners. 246 246
That might be 50, a hundred 247 247
or 200 gigabytes of data or more. 248 248
I guarantee that our data loss prevention system 249 249
is going to flag on that amount of data, 250 250
leaving our network from a single user 251 251
or a single workstation, 252 252
because this is typically an indicator of a compromise 253 253
for a data breach or data exfiltration attack. 254 254
My DLP will flag this data transfer 255 255
and based on our policies, 256 256
it may even block this data transfer from occurring. 257 257
Now our administrator can review that flagged alert 258 258
and look at the content and determine 259 259
is this somebody who is stealing from us 260 260
or is it someone doing their job 261 261
and they have a legitimate reason to do this? 262 262
For example, if I have my video editor, 263 263
we might see that she just uploaded this brand new course 264 264
to one of our distribution partners. 265 265
And she did it all in a one day period. 266 266
So she had to upload two or 300 gigabytes of data 267 267
so we can prepare to publish this course. 268 268
That would be fine. 269 269
We'd mark the alert as normal and acceptable, 270 270
and we'd move on with our day. 271 271
But again, this is all going to be dependent 272 272
on your data loss prevention policies. 273 273
And what's going to trigger inside your company. 274 274
In your company, if you had a single person 275 275
sending 50 or a hundred gigabytes of data, 276 276
that would probably be extremely suspicious in most cases 277 277
and needs to be investigated further. 278 278
As part of your DLP policy, it's always important 279 279
to set proper thresholds. 280 280
When is your DLP going to alarm? 281 281
What is the amount of data transfer or the file types 282 282
that it's going to consider acceptable or out of baseline? 283 283
What file formats are you going to be able to transfer? 284 284
And which ones are going to be blocked? 285 285
Are you going to allow people to transfer database files 286 286
or zip files or PowerPoint files? 287 287
All of these are things that DLP can block 288 288
or alert on depending on how you configure it. 289 289
So as you look at all these different things, 290 290
you need to define that in your data loss prevention policy. 291 291
Now, remember when it comes to securing your networks, 292 292
there are lots of different hardening techniques 293 293
and security policies that you may come across. 294 294
We cover just a few in this lesson 295 295
that you may get asked about on the exam, 296 296
but in the real world there are tons 297 297
of other ones out there. 298 298
For the exam, I want you to remember 299 299
that we have things like password policies, 300 300
acceptable use policies, 301 301
bring your own device policies, 302 302
remote access policies, 303 303
onboarding and offboarding policies, 304 304
security policies, 305 305
and data loss prevention policies, 306 306
and what each one is used for.