In this lesson,
we're going to cover policies and handbooks.
Now, policies and handbooks are not just documents
that are gathering dust on your shelf
or take up storage space on your computer,
but instead, you should really use these
as living, breathing guidelines that shape your behavior,
decision making, and protocols within your organization.
Now, it is crucial to understand that these policies
and handbooks aren't going to be the same
across every organization you work at,
because each organization will operate
their business functions based on
their specific industry, needs, and use cases.
Therefore, your organization's policies on data management,
for example, might be drastically different
from the one you used at another company
that you previously worked at.
This is why it is really important
that you not just read your organization's policies
and handbooks, but that you also fully
comprehend and understand them.
So what is a policy and what is a handbook?
Well, a policy is a deliberate system of principles
and rules that guide decisions
and achieve rational outcomes,
and they're typically crafted
to uphold an organization's internal controls
and ensure compliance with legal and ethical standards.
A handbook, on the other hand, is a comprehensive guide,
usually in booklet form, that provides
detailed information on procedures, guidelines,
and best practices to assist individuals in understanding
and navigating specific operational aspects
of an organization.
These policies and handbooks can be written to cover
a myriad of different things inside of your organization.
For example, you might have a policy on data protection,
one for remote work, another for acceptable use
of technology, and yet another for conflicts of interest
and things like that.
On the other hand, handbooks might be created
for employees, another one for training,
another for compliance, and things like that.
For example, let's assume you just got hired on
at a new company and you want to throw away
or discard a five page printout
that contains sensitive data on it,
like your organization's last quarter sales numbers
that are not yet being released to the public.
How should you dispose of this paper?
Should you throw it away?
Should you recycle it?
Should you shred it?
Should you burn it?
Well, it all depends, but if you check
your organization's data destruction policy,
it will clearly define the right way
for you to dispose of this type of printout that contains
your organization's sensitive financial data audit.
At one organization I worked at, there was a policy
that said that anything that was printed out
that contains sensitive information
had to be printed on a specific printer
that was loaded with pink paper.
In that same policy, it stated that any pink paper
was not allowed to be thrown away or recycled.
It had to be shredded using a cross-cut shredder
to prevent any of that sensitive data from being the victim
of a dumpster diving attack.
Now, I also worked at a high security
governmental organization in the past,
and they had a similar process
where white paper was used for unclassified documents,
pink was used for secret documents,
and yellow was used for top secret documents.
For white documents, you could recycle them.
For pink documents, you could shred them.
But for yellow documents, you had to incinerate or burn them
using our organization's internal processes.
Another common area that you need to review
inside your organization's policies and handbooks
concerns remote work or taking work home.
These days, remote work and work from home
have become fairly normal in most industries,
but several organizations still do not allow this to occur
because of a wide variety of security issues
that could arise from allowing remote work
or work from home.
So you need to review your organization's policies
and handbooks to determine
what their remote work policy is going to be,
because many organizations have strict guidelines
on what type of information can actually leave
the physical confines of their office building.
These policies and handbooks aren't just focused
on the digital files, but they also include
what you should be doing with physical files
that somebody may want to take home
with them to do work at home.
For example, when I worked at that high security
government organization, we were not allowed
to have smartphones or personal digital assistants
inside of the building.
So I always carried around with me an old fashioned notebook
all day long to take notes
at all the various meetings I attended.
I'd also write down any tasks or appointments I had
and things like that.
Now, at the end of the day,
I can't take this notebook home with me though
because it has sensitive information written in it
about things that were secret or top secret,
depending on the meetings I was attending during that day.
So this organization had a policy that said
what kind of things could be taken home with you
and worked on and which ones couldn't.
For example, if I had to do
my annual cybersecurity training, I could do that from home
because I could log into an internet-based website
and complete it from there
as part of my work from home hours.
But for about 99% of the other things
I did on a weekly basis, I couldn't do those at home
because they were classified as secret or top secret.
And so I couldn't work on those things
unless I was inside of the official government building
because that's where that secret information was located.
In fact, at this organization,
anytime you left the building,
they would actually look through your backpacks,
your briefcases, and your purses to ensure
you didn't inadvertently take home any documents
that might violate their data protection policies.
Now, this isn't just a matter of trust,
it's about securing the organization's information,
and your home probably hasn't been vetted
by your organization's security team
to hold top secret information, right?
So we don't want any secret or top secret documents
sitting in your home office where somebody
can break into your house and steal them easily.
Instead, we want them in our secure facilities
that are provided by the government.
Now, up to this point, I've been focusing
on policies and handbooks that tell us
what we aren't allowed to do.
But a lot of policies and handbooks will also provide you
with guidance for navigating
your day-to-day responsibilities
and what you are allowed to do.
For example, these policies and handbooks
are going to cover everything from how to handle a data breach
to the steps for reporting suspicious activities.
Let's pretend for a moment
that you just received a strange email,
and as you read that email,
your gut tells you there's just something
not right about it.
Well, how do you report it?
If you check the chapter in your employee handbook,
it'll tell you who to contact, what information to provide,
and how to isolate the potential threat that is represented
by this email for your organization's systems.
These policies and handbooks also evolve over time
because cybersecurity isn't static,
and what was relevant two years ago
might not be something we need to think about today.
For this reason, every policy and handbook
needs to be reviewed at least once per year
and updated as appropriate.
Additionally, when the policy or handbook is updated,
your organization must ensure that your employees
take the time to read the latest versions as well.
If there's any significant changes,
you should probably highlight those
in a single one-page summary too,
and provide that with the policy.
After all, you don't want a system administrator
who missed a memo on the updated protocol
for your organization's password complexity
to not implement those changes on your domain controller
or other important systems and servers
simply because they missed the memo.
Now, as much as we rely on these policies and handbooks,
it is worth noting that they are not foolproof.
Mistakes are going to happen, breaches are going to occur,
and new threats are going to emerge
that may not have been covered
in your training or in your handbook.
For this reason, it's important to train your employees
on the why behind your policies and handbooks
because they may be asked to make a judgment decision
when the policy doesn't specifically cover something
that comes up in their daily work.
Your policies and handbooks should always be designed
to foster a secure environment and a culture of mindfulness.
If you encounter something that doesn't fit the mold,
it's not just your right,
but also your responsibility to bring it up
to your management and leadership teams
because that way, they can provide you guidance
and help you in that decision making.
This is what we're referring to when we talk about
creating a culture of security.
So remember, your organization's policies and handbooks
are going to be used to help you make informed decisions
and be a proactive part
of your organization's cybersecurity mechanisms.
They serve as guides, not guardrails,
to help your employees understand the principles behind them
and recognize when something doesn't quite line up.
So take the time to read
your organization's policies and handbooks,
and if you're ever in doubt, ask for additional guidance
or clarification from your management or leadership team.
After all, there is no question that is too insignificant
to your organization's overall cybersecurity posture
except the one that isn't asked.