Standards.
Standards are a huge aspect when it comes to governance.
They provide a framework for implementing security measures
ensuring that all aspects
of an organization's security posture are addressed.
In this lesson, we all delve into the standards
focusing on password standards, access control standards,
physical security standards, and encryption standards.
First, password standards.
Password standards are fundamental to any security policy.
They dictate the complexity and management of passwords
which are the first line of defense
against unauthorized access.
Password standards are defined to ensure robustness
and resistance against brute force attacks.
Password standards often include requirements
such as a minimum length of eight to 12 characters,
the use of a mix of uppercase and lowercase letters,
numbers, and special characters.
Also, they can enforce regular password changes,
typically every 60 to 90 days, and prohibit password reuse
for a certain number of iterations.
Additionally, standards can emphasize
the importance of password management tools and techniques
such as password hashing and salting
to further enhance password security.
These tools ensure that even
if a password database is compromised,
the actual passwords remain secure.
Next up, access control standards.
Access control standards are another critical aspect
of cybersecurity.
They determine who has access to what resources
within an organization.
There are several access control models
that you should know about,
including discretionary access control, or DAC,
mandatory access control, or MAC
and role-based access control, or RBAC.
Discretionary access control allows the order
of the information or resource to decide who can access it.
Mandatory access control, on the other hand uses labels
or classifications to determine access,
often used in government or military settings.
Role-based access control assigns access based on roles
within an organization, ensuring that users
only have access to the resources
necessary for their job functions.
These standards might also cover the principles
of least privilege and separation of duties.
The least privilege principle
ensures that users only have the minimum levels
of access required to perform their duties.
Separation of duties prevents any single individual
from having complete control over a critical process
or system, reducing the risk of insider threats.
Then we have physical security standards.
Physical security standards, while often overlooked
are just as important as their digital counterparts.
These standards cover the physical measures
taken to protect an organization's asset and information.
Physical security standards
include physical security controls like perimeter security,
such as fences, gates, guards,
surveillance systems like CCTV and access control mechanisms
such as biometric scanners and keycards.
Additionally, it covers environmental controls
such as fire suppression systems, HVAC controls,
and power redundancy systems.
These standards also emphasize the importance
of secure areas for sensitive information or systems
such as server rooms or data centers.
These areas should have additional security measures
including stricter access controls and surveillance.
Finally, encryption standards.
Encryption standards are a cornerstone of data security.
They ensure that even if data is intercepted
or accessed without authorization,
it remains unreadable and secure.
Encryption standards, for example,
might enforce the use of the Advanced Encryption standard
or AES, RSA and the secure hash algorithm 2 or SHA-2.
These standards are widely recognized and used
in various applications from encrypting data at risk,
storage devices to data in transit over networks.
The choice of encryption standard often depends
on the specific cues and the balance
between security and performance.
For example, AES is often used for data at rest
due to its strong security and efficient performance
while RSA is commonly used for secure communication
due to its public key infrastructure nature.
So remember, standards are an important part
of an organization's governance framework.
These standards include password standards,
access control standards, physical security standards
and encryption standards.
By adhering to these standards, organizations can ensure
a robust and comprehensive approach
to their cybersecurity efforts.