1 00:00:00,180 --> 00:00:01,350 Standards. 2 00:00:01,350 --> 00:00:04,290 Standards are a huge aspect when it comes to governance. 3 00:00:04,290 --> 00:00:07,230 They provide a framework for implementing security measures 4 00:00:07,230 --> 00:00:08,490 ensuring that all aspects 5 00:00:08,490 --> 00:00:11,520 of an organization's security posture are addressed. 6 00:00:11,520 --> 00:00:14,100 In this lesson, we all delve into the standards 7 00:00:14,100 --> 00:00:17,400 focusing on password standards, access control standards, 8 00:00:17,400 --> 00:00:20,940 physical security standards, and encryption standards. 9 00:00:20,940 --> 00:00:22,740 First, password standards. 10 00:00:22,740 --> 00:00:26,040 Password standards are fundamental to any security policy. 11 00:00:26,040 --> 00:00:29,100 They dictate the complexity and management of passwords 12 00:00:29,100 --> 00:00:30,480 which are the first line of defense 13 00:00:30,480 --> 00:00:32,850 against unauthorized access. 14 00:00:32,850 --> 00:00:35,820 Password standards are defined to ensure robustness 15 00:00:35,820 --> 00:00:38,970 and resistance against brute force attacks. 16 00:00:38,970 --> 00:00:41,610 Password standards often include requirements 17 00:00:41,610 --> 00:00:44,520 such as a minimum length of eight to 12 characters, 18 00:00:44,520 --> 00:00:47,670 the use of a mix of uppercase and lowercase letters, 19 00:00:47,670 --> 00:00:49,860 numbers, and special characters. 20 00:00:49,860 --> 00:00:52,800 Also, they can enforce regular password changes, 21 00:00:52,800 --> 00:00:57,060 typically every 60 to 90 days, and prohibit password reuse 22 00:00:57,060 --> 00:00:59,760 for a certain number of iterations. 23 00:00:59,760 --> 00:01:02,070 Additionally, standards can emphasize 24 00:01:02,070 --> 00:01:05,340 the importance of password management tools and techniques 25 00:01:05,340 --> 00:01:07,680 such as password hashing and salting 26 00:01:07,680 --> 00:01:10,200 to further enhance password security. 27 00:01:10,200 --> 00:01:11,790 These tools ensure that even 28 00:01:11,790 --> 00:01:14,010 if a password database is compromised, 29 00:01:14,010 --> 00:01:16,323 the actual passwords remain secure. 30 00:01:17,220 --> 00:01:20,040 Next up, access control standards. 31 00:01:20,040 --> 00:01:23,100 Access control standards are another critical aspect 32 00:01:23,100 --> 00:01:24,240 of cybersecurity. 33 00:01:24,240 --> 00:01:26,790 They determine who has access to what resources 34 00:01:26,790 --> 00:01:28,530 within an organization. 35 00:01:28,530 --> 00:01:30,690 There are several access control models 36 00:01:30,690 --> 00:01:31,740 that you should know about, 37 00:01:31,740 --> 00:01:34,590 including discretionary access control, or DAC, 38 00:01:34,590 --> 00:01:36,660 mandatory access control, or MAC 39 00:01:36,660 --> 00:01:39,750 and role-based access control, or RBAC. 40 00:01:39,750 --> 00:01:42,060 Discretionary access control allows the order 41 00:01:42,060 --> 00:01:45,720 of the information or resource to decide who can access it. 42 00:01:45,720 --> 00:01:48,660 Mandatory access control, on the other hand uses labels 43 00:01:48,660 --> 00:01:51,150 or classifications to determine access, 44 00:01:51,150 --> 00:01:54,240 often used in government or military settings. 45 00:01:54,240 --> 00:01:57,090 Role-based access control assigns access based on roles 46 00:01:57,090 --> 00:01:59,160 within an organization, ensuring that users 47 00:01:59,160 --> 00:02:00,900 only have access to the resources 48 00:02:00,900 --> 00:02:03,120 necessary for their job functions. 49 00:02:03,120 --> 00:02:05,280 These standards might also cover the principles 50 00:02:05,280 --> 00:02:07,860 of least privilege and separation of duties. 51 00:02:07,860 --> 00:02:09,389 The least privilege principle 52 00:02:09,389 --> 00:02:12,330 ensures that users only have the minimum levels 53 00:02:12,330 --> 00:02:15,150 of access required to perform their duties. 54 00:02:15,150 --> 00:02:18,180 Separation of duties prevents any single individual 55 00:02:18,180 --> 00:02:21,510 from having complete control over a critical process 56 00:02:21,510 --> 00:02:25,140 or system, reducing the risk of insider threats. 57 00:02:25,140 --> 00:02:28,350 Then we have physical security standards. 58 00:02:28,350 --> 00:02:30,810 Physical security standards, while often overlooked 59 00:02:30,810 --> 00:02:34,200 are just as important as their digital counterparts. 60 00:02:34,200 --> 00:02:36,480 These standards cover the physical measures 61 00:02:36,480 --> 00:02:40,200 taken to protect an organization's asset and information. 62 00:02:40,200 --> 00:02:41,700 Physical security standards 63 00:02:41,700 --> 00:02:44,850 include physical security controls like perimeter security, 64 00:02:44,850 --> 00:02:47,520 such as fences, gates, guards, 65 00:02:47,520 --> 00:02:51,600 surveillance systems like CCTV and access control mechanisms 66 00:02:51,600 --> 00:02:54,810 such as biometric scanners and keycards. 67 00:02:54,810 --> 00:02:57,480 Additionally, it covers environmental controls 68 00:02:57,480 --> 00:03:00,510 such as fire suppression systems, HVAC controls, 69 00:03:00,510 --> 00:03:03,270 and power redundancy systems. 70 00:03:03,270 --> 00:03:05,550 These standards also emphasize the importance 71 00:03:05,550 --> 00:03:09,180 of secure areas for sensitive information or systems 72 00:03:09,180 --> 00:03:11,640 such as server rooms or data centers. 73 00:03:11,640 --> 00:03:14,340 These areas should have additional security measures 74 00:03:14,340 --> 00:03:18,060 including stricter access controls and surveillance. 75 00:03:18,060 --> 00:03:19,920 Finally, encryption standards. 76 00:03:19,920 --> 00:03:22,860 Encryption standards are a cornerstone of data security. 77 00:03:22,860 --> 00:03:25,020 They ensure that even if data is intercepted 78 00:03:25,020 --> 00:03:27,360 or accessed without authorization, 79 00:03:27,360 --> 00:03:29,643 it remains unreadable and secure. 80 00:03:30,690 --> 00:03:32,580 Encryption standards, for example, 81 00:03:32,580 --> 00:03:35,130 might enforce the use of the Advanced Encryption standard 82 00:03:35,130 --> 00:03:40,130 or AES, RSA and the secure hash algorithm 2 or SHA-2. 83 00:03:41,010 --> 00:03:43,830 These standards are widely recognized and used 84 00:03:43,830 --> 00:03:47,040 in various applications from encrypting data at risk, 85 00:03:47,040 --> 00:03:51,180 storage devices to data in transit over networks. 86 00:03:51,180 --> 00:03:53,580 The choice of encryption standard often depends 87 00:03:53,580 --> 00:03:55,950 on the specific cues and the balance 88 00:03:55,950 --> 00:03:57,870 between security and performance. 89 00:03:57,870 --> 00:04:01,650 For example, AES is often used for data at rest 90 00:04:01,650 --> 00:04:04,650 due to its strong security and efficient performance 91 00:04:04,650 --> 00:04:07,680 while RSA is commonly used for secure communication 92 00:04:07,680 --> 00:04:10,230 due to its public key infrastructure nature. 93 00:04:10,230 --> 00:04:12,990 So remember, standards are an important part 94 00:04:12,990 --> 00:04:15,150 of an organization's governance framework. 95 00:04:15,150 --> 00:04:17,130 These standards include password standards, 96 00:04:17,130 --> 00:04:19,920 access control standards, physical security standards 97 00:04:19,920 --> 00:04:21,480 and encryption standards. 98 00:04:21,480 --> 00:04:24,810 By adhering to these standards, organizations can ensure 99 00:04:24,810 --> 00:04:27,210 a robust and comprehensive approach 100 00:04:27,210 --> 00:04:29,523 to their cybersecurity efforts.