for Arapahoe CC class

1. CNG 125 – Network
Policies and
Procedures
Frank Vianzon

2. Network Design
• Conducting a needs assessment
• Physical and logical topology
• What services?
– DHCP
– DNS
– Directory Services
– File and Print
– Database
– Web Servers

3. Network Documentation
• Policy
– Document that describes the overall goals
• Regulation
– Requirement published by a government body
• PCI DSS -
https://www.pcisecuritystandards.org/security_st
andards/
– Data at rest
– Data in transit
• HIPPA
• GLBA – Gramm Leach Bliley Act

4. Classification of Data
• Category 4: Highly sensitive corporate and customer
data that if disclosed could put the organization at
financial or legal risk.
• Category 3: Sensitive internal data that if disclosed
could negatively affect operations.
• Category 2: Internal data that is not meant for public
disclosure.
• Category 1: Data that may be freely disclosed with the
public.

5. Procedure
• Step by Step process outlining how to implement a
specific action

6. Network Diagram
• Shows the logical and/or physical layout of your network
• Also related is wiring schematic

7. Configuration
• Identifies specific configuration information for a device.

8. Change / Job Logs
• Logbook
• Tickets
• Change Management

9. Baseline
• Snapshot of performance statistics of the network or
devices

10. Asset Management Facts
• Procurement
– Who to buy it from?
– Lifecycle
• Deployment
• Operations
– AUP
• Decommission
• Disposal

11. Safety Facts
• Electrical Safety
• Physical Hazards
• Employee and Visitor Safety
• Hazardous Materials

12. 12.2 Fire Safety Facts
• Fire Safety
– Portable
– Fixed
• Deluge (dry)
• Wet Pipe

13. 12.2.5 ESD
• Electrostatic

14. 12.2.7 Emergency Facts
• Lighting
• Egress
• Fire Safety

15. 12.3.2 Risk Management
• Asset
• Threat
• Vulnerability
• Threat Agent
• Threat Vector
• Threat Probability
• Attack
• Countermeasure
• Exposure
• Loss
• Risk Residual Risk
• Compensating Controls
• Breach!

16. Risk Management
• Asset Identification
• Threat Identification
• Risk Assessment
– Where is the device located?
• Risk Response

17. 12.3.4 Business Continuity
• Business Continuity Plan
• Business Impact Analysis
• Disaster Recovery Plan

18. 12.4.2 Security Policy
• Acceptable Use
• Authorized Access
• Change and Configuration Management
• Code of Ethics
• Human Resource Policies
• Password
• Privacy
• User Education and Awareness Training
• User Management

19. 12.4.4 Third Party
• Onboarding
• Ongoing Operations
• Off-Boarding

20. 12.4.6 Security Assessment