Let's continue looking at security operations for
the Certified in Cybersecurity.
Security operations and administration is where we
actually put to practice all of the good security
principles we've talked about until now.
We started out by looking at protecting data,
the most valuable asset of the organization.
Now we'll look at the way we introduce and then,
of course,
enforce good security practices before we go on to security awareness
training and the exam review tips and techniques.
It is important that a security program is managed.
Managed means that we have correct oversight,
ownership,
and certainly that we're monitoring what is the health of our security program.
This is something we looked at earlier when we called it governance,
governance being that ownership by management of the security program.
The management should help us to develop and certainly be
committed to the security strategy.
They should be actively interested in whether or not we are
compliant with good practices through monitoring and certainly
complying with the various laws, privacy,
for example, types of laws,
and just good practices and protecting the assets of the organization.
One of the hard parts of this is enforcement.
There are times when we are going to have to take some type of disciplinary
action if a person is not following the policies and procedures.
But security is not something that happens just by nature.
It's something that has to be put in place through
the use of things like policies.
So people know what they must and must not do, of course.
Policies are actually signed and issued on behalf of management.
Management should sign them,
which attest to the fact that they are committed to the enforcement and,
of course, the use of these policies.
But a policy is no good if nobody knows about it.
It has to be communicated to the staff,
and it should be communicated in such a way that it mandates requirements.
I had an example of this.
I was teaching some security awareness programs for a government,
and the problem was that I had put together all of what
their policies were and was showing this,
first of all, to the managers, and the manager said yes,
but you're missing something.
Well, what am I missing?
You didn't put the policy number on every slide.
I said well, this is the policy.
But they said but it won't be seen as authoritative if it
doesn't have the policy number with it.
And they were right.
They knew their staff,
and they knew that the moment the students that attended
those programs saw that not only was this good practice and
something we are encouraging, but it was something was mandated by policies like,
oh, okay, we have to do this.
And that is the thing.
People have to realize that policy is not just a suggestion or a good idea.
The idea is that through policy we can influence people's behaviors,
A lot of what we're trying to do when we look at security
awareness is actually change people's actions.
Well changing people's actions can be done either through pressure.
If you don't do this, you can lose your job.
Or we can change their actions by influencing their beliefs.
Do they believe this is a good thing to do?
Well then they'll do it.
So policy in many ways tries to communicate what is a good thing to do.
So hopefully they believe in it and then follow it.
We know that a policy should have some type of disciplinary action in it.
Failure to abide by this policy may result in disciplinary action
up to and including termination of employment,
for example.
It is important that our policies are up to date.
For many organizations, the policies that they have are years out of date.
They don't even address today's real world of technologies for example.
And so people don't get the direction they need on what they should and,
of course, shouldn't do.
We said that a high‑level policy should not be technical because a
high‑level policy provides that strategic overview,
and you don't want to have to change that policy every time technology changes.
With many organizations, coming out with a new policy might take 2 years.
So therefore,
we have a high‑level policy that is then reinforced or
supported by functional policies.
Functional policies are the ones that address specific
technologies or an area of concern,
for example remote access or bring your own device,
for example.
But a policy is nothing but words.
It sounds good on paper, but it has to be backed up with the how to.
And that is why we have procedures.
Procedures tell us how to abide by the policy.
Standards set the bar of what is acceptable or not.
And baselines ensure that we set this bar consistently across the organization,
not that everybody interprets policy in a different way.
Some examples of common functional policies,
for example, in an area of concern, is acceptable use.
Acceptable use policy is something that's kind of interesting because a
number of years ago when people had a phone on their desk,
it was often said this phone is for business use only.
Well, that was a little bit unrealistic.
And of course, that's by no means good with today's world.
The organizations very often had to change that and
say this is for business use.
But depending on your manager, there could be reasonable personal use as well.
If you have to call your partner and say I'm going to be late
for dinner because I'm working on something,
well, that's reasonable personal use.
And there's where we, again, use a word that is open to interpretation.
What is reasonable?
We don't want someone spending the whole day,
for example, just chatting with friends when they should be doing some work.
So we often see this with acceptable use of the internet.
It's there primarily for work purposes.
But if you have a few minutes and want to check something on the latest news,
that's reasonable use.
A lot comes down to the culture of our organization.
Are we very restrictive, or are we very permissive?
And this is not to say one is better than the other.
But obviously, we need to know what the culture of our organization is.
Very restrictive controls that sort of try to limit everything within a
very tight set of behaviors or very permissive that says,
yeah, you can do pretty much anything.
Just don't do anything that's really bad.
We see one of the areas here is the area of piracy.
We see a lot of people try to download something maybe off the internet,
maybe some cool software or a game or even some type of entertainment.
That could very much be in violation of piracy laws
because piracy laws say that, yeah,
you can't just download this and use it without paying for the use of that,
for example.
And it's not good for an organization all of a sudden to find
out that they have all kinds of pirated,
say, movies on their servers, for example.
Another common policy is data handling, an important one.
We know that data protection is important.
Data handling tells people how to actually handle the
data usually based on classification.
So some of the areas we would address in this would include
only share data on a need‑to‑know basis.
We don't need to make data available to someone who
doesn't need it in order to do their job.
And when it comes to sharing data, can you share it with a customer,
can you share with a business partner, with a coworker?
And of course, if it's law enforcement,
what are the conditions under which that sharing must take place?
One of the things we have to worry about is inference.
If I tell a person one thing, they could maybe guess something else.
So that's why we have to be careful with what data we share and don't share.
If we turn around and say to somebody no,
I'm not allowed to tell you about that,
they can infer that there's something there that is
important that they are not aware of.
They can infer that or deduce that.
Closely related to that is the area of aggregation.
Aggregation is where, if I give a personal bunch of small pieces of information,
they could collect them together, aggregate them,
to learn something that I didn't want them to know.
So when we're dealing with data, we have to be careful with these things.
What data are we sharing that could lead to someone learning something they
shouldn't know through either inference or aggregation?
We should have a clear policy on how data must be destroyed at end of life.
Does it need to be shredded, or can it just be deleted?
Is overwriting good enough?
Well,
that doesn't work too well in the cloud where we can't guarantee
it will even overwrite into the same place.
Many organizations have policies such as the clean desk and clear screen.
If you're not at your desk,
there should be nothing on your desk or on your screen which is confidential.
Lock it,
put things away so that nobody walking by could see
something that should not be then disclosed.
Most organizations have a password policy,
and there's been a lot of debate over the years about
passwords and what's a sufficiently long password.
Should we require people to change their password?
We're not going to try and tell you what you should do.
But certainly,
you should have a policy so at least people know what
is expected in your organization.
How long does the password need to be?
A minimum of eight characters?
A minimum of four?
Well, we at least tell people what the baseline is, say it's eight characters.
You can have a 12 or 15‑character password if you want,
but it must be at least 8 characters as an example.
Does it have to include upper and lowercase?
Is it something that has to have numbers or special characters?
That is the complexity of the password that can make it much more
difficult for someone to guess that password.
And of course, we quite often say don't base it just on a common word.
Should it expire?
There's been a lot of debate about this.
Even the security community leaders,
people like Bruce Schneier who often says don't make passwords expire.
He says you have to think of what do we say to our users every day.
Choose a password that's impossible to remember, but never write it down.
Well, of course, that's unrealistic.
So we have to try to make security possible and simple for people.
And maybe we have them expiring, maybe not.
It depends on what is the risk and what is the way our
organization has chosen to deal with this,
but then communicate that.
And of course,
we should have guidelines and policy and say can you
share your password with somebody else?
IT is famous for this.
IT, very often,
we have a number of people sharing an account known as administrator
all with the same user account number and password.
And maybe that's something that we should,
in our password policy, certainly try to prohibit or discourage,
but it's hard to do.
You take with the executive management team.
Very often,
you'll find that the senior executives share their
password with their assistants and so on so they can get
into their email accounts and so on.
So right at the top,
we have a failure to abide by what an organization's policy might be.
And of course,
one of the things that's important here is not to use the
same password for multiple systems.
This is where single sign‑on is good so you don't have to have many passwords.
But let's say you have a password on your social media account.
You think who cares if somebody gets into my Facebook
or Twitter or Signal or WhatsApp.
Who cares?
But,
if that's the same password I use on some of the very sensitive systems
in the company and someone learns my Twitter password,
does that mean they can now get into the other systems
that we really do want protected?
So that's why we have to be very careful and provide
guidance on whether or not you should ever use the same
password on multiple types of systems.
And of course, should we ever share our passwords with anybody else?
One of the things that's certainly been emerging in
the last few years is this BYOD, bring your own device.
And, in fact, in some companies, it's actually called choose your own device.
Here's a series of different, say, phones you could choose from.
You can't just choose any phone,
but you can choose from these three or four the one you would think is best.
And many organizations have moved towards this BYOD.
Use the equipment you're comfortable with, the laptop, the phone, whatever.
But then we should certainly ensure that those devices are properly configured.
Does that mean, for example, it would have things like antispam,
a firewall on it, antimalware.
And what happens if there's a problem?
If we have to do an investigation,
does the company have the right to seize that phone and look at it.
Well this is where we get into a little bit of a legal problem in some
cases because it could well be that if I have a phone that has both my
personal data and corporate data on it,
under no circumstances does the company necessarily have
the right to look at my personal data.
And so this is something we should certainly address in policy as well,
the right to review or audit those devices.
If I'm going to keep sensitive corporate data,
organizational data on my phone,
do I have then some type of mobile device management,
which would create a sandbox on it so that all of the company's
data is kept in a virtual machine that maybe even could be remotely
white if that phone was lost or stolen.
Another, of course, is privacy,
having a policy here that is compliant with the laws and
regulations and the concept of need to know.
This may require that we obfuscate data.
We make data so that, if we are displaying it,
you can't see the whole credit card number.
You can only see the last four digits.
A person types in their password and all we see is a series of dots,
for example.
That's a type of masking or obfuscation of the data.
So someone who is shoulder surfing or looking over your shoulder
while you're typing your password wouldn't actually be able to see
what the password characters were.
It is very good to use screen filters.
I've seen this as I've flown a lot in airplanes and somebody opens up
their laptop and starts working on something for work.
And here I am squeezed in the seat beside them and I can
see confidential corporate data that really they shouldn't
be showing in a public place.
Buy a screen filter so that a person who's not
directly behind the screen can't read it,
but of course especially when you're dealing with sensitive information
on our phones and our laptops and iPads and so on.
We also have to address the area of investigation.
If there's something that's gone wrong,
we need to make sure that everything about that investigation is kept
quiet until the investigation is then closed off.
We don't want to reveal the fact that we're looking at something
because it could well be that there is nothing there.
And if there's no suspicion,
it can easily be that black mark never leaves that person.
He was under investigation for that, for example.
So these are examples of some of the functional policies
that many organizations put in place.
So they have now taken the concepts of security and turned them
into real practical operations and administration.