Computer Security Fundamentals by Chuck Easttom Chapter 10 Security Policies * © 2016 Pearson, Inc. Chapter 10 Computer Security Policies * Chapter 10 ObjectivesRecognize the importance of security policiesUnderstand the various policies and the rationale for themKnow what elements go into good policiesCreate policies for network administrationEvaluate and improve existing policies © 2016 Pearson, Inc. Chapter 10 Computer Security Policies * Explain what cyber terrorism is and how it has been used in some actual cases. Understand the basics of information warfare. Have a working knowledge of some plausible cyber terrorism scenarios. Have an appreciation for the dangers posed by cyber terrorism. © 2016 Pearson, Inc. Chapter 10 Computer Security Policies * Introduction Technology by itself cannot solve all network security problems. © 2016 Pearson, Inc. Chapter 10 Computer Security Policies * Cyber terrorism, according to the definition of the FBI: Premeditated, politically motivated attack against information, computer systems, computer programs, and data that results in violence against noncombatant targets by subnational groups or clandestine agents. Typically, loss of life in a cyber attack would be less than in a bombing attack. © 2016 Pearson, Inc. Chapter 10 Computer Security Policies * Introduction (cont.)Virus software won't prevent a user from manually opening an attachment and releasing a virus.A technologically secured network is still vulnerable if former employees (perhaps some unhappy with the company) still have working passwords. Or if passwords are simply put on Post-it notes on computer monitors.A server is not secure if it is in a room that nearly everyone in the company has access to.Your network is not secure if end users are vulnerable to social engineering. © 2016 Pearson, Inc. Chapter 10 Computer Security Policies * All these could lead to significant deaths: train wrecks, hospital deaths, loss of air traffic control resulting in plane crashes, and so forth. © 2016 Pearson, Inc. Chapter 10 Computer Security Policies * What Is a Policy?A security policy is a document that defines how an organization deals with some aspect of security. There can be policies regarding end-user behavior, IT response to incidents, or policies for specific issues and incidents. © 2016 Pearson, Inc. Chapter 10 Computer Security Policies * All these could lead to significant deaths: train wrecks, hospital deaths, loss of air traffic control resulting in plane crashes, and so forth. © 2016 Pearson, Inc. Chapter 10 Computer Security Policies * Defining User PoliciesPasswordsInternet useE-mail attachmentsInstalling/uninstalling softwareInstant messagingDesktop configuration © 2016 Pearson, Inc. Chapter 10 Computer Security Policies * All these could lead to significant deaths: tr.

1. Computer Security Fundamentals
by Chuck Easttom
Chapter 10 Security Policies
*
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Chapter 10 ObjectivesRecognize the importance of security
policiesUnderstand the various policies and the rationale for
themKnow what elements go into good policiesCreate policies
for network administrationEvaluate and improve existing
policies
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Explain what cyber terrorism is and how it has been used in
some actual cases.
Understand the basics of information warfare.
Have a working knowledge of some plausible cyber terrorism
scenarios.
Have an appreciation for the dangers posed by cyber terrorism.

2. © 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Introduction Technology by itself cannot solve all network
security problems.
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Cyber terrorism, according to the definition of the FBI:
Premeditated, politically motivated attack against information,
computer systems, computer programs, and data that results in
violence against noncombatant targets by subnational groups or
clandestine agents.
Typically, loss of life in a cyber attack would be less than in a
bombing attack.
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Introduction (cont.)Virus software won't prevent a user from
manually opening an attachment and releasing a virus.A
technologically secured network is still vulnerable if former
employees (perhaps some unhappy with the company) still have
working passwords. Or if passwords are simply put on Post-it
notes on computer monitors.A server is not secure if it is in a
room that nearly everyone in the company has access to.Your
network is not secure if end users are vulnerable to social
engineering.
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*

3. All these could lead to significant deaths: train wrecks, hospital
deaths, loss of air traffic control resulting in plane crashes, and
so forth.
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
What Is a Policy?A security policy is a document that defines
how an organization deals with some aspect of security. There
can be policies regarding end-user behavior, IT response to
incidents, or policies for specific issues and incidents.
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
All these could lead to significant deaths: train wrecks, hospital
deaths, loss of air traffic control resulting in plane crashes, and
so forth.
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Defining User PoliciesPasswordsInternet useE-mail
attachmentsInstalling/uninstalling softwareInstant
messagingDesktop configuration
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
All these could lead to significant deaths: train wrecks, hospital
deaths, loss of air traffic control resulting in plane crashes, and
so forth.

4. © 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
System Admin PoliciesNew EmployeesDeparting
EmployeesChange ControlAccess Control
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
All these could lead to significant deaths: train wrecks, hospital
deaths, loss of air traffic control resulting in plane crashes, and
so forth.
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Other IssuesBring Your Own DeviceA major concern in the
modern networkNew EmployeesDeparting Employees
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Bring your own device (BYOD) has become a significant issue
for most organizations. Most, if not all, of your employees will
have their own smart phones, tablets, smart watches, and Fitbits
that they will carry with them into the workplace. When they
connect to your wireless network, this introduces a host of new
security concerns. You have no idea what networks that device
previously connected to, what software was installed on them,

5. or what data might be exfiltrated by these personal devices.
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Change ManagementRFCCABFollow-up
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Software Development PoliciesSecurity standardsTesting
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Incident Response PoliciesHandling virusesDealing with
breaches
© 2016 Pearson, Inc. Chapter 10 Computer Security

6. Policies
*
All these could lead to significant deaths: train wrecks, hospital
deaths, loss of air traffic control resulting in plane crashes, and
so forth.
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Data ClassificationPublicSecure
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
BCP and DRPDRPBCPBIA
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
© 2016 Pearson, Inc. Chapter 10 Computer Security

7. Policies
*
Fault ToleranceBackupsFull: All changesDifferential: All
changes since last full backupIncremental: All changes since
last backup of any typeRAID
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
Relevant Laws & RegulationsHIPAASarbanes-OxleyPCI
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
SummaryIn this chapter, you learned the technology is not
enough to ensure a secure network. You must have clear and
specific policies detailing procedures on your network. Those
policies must cover employee computer resource use, new
employees, outgoing employees, access rights, how to respond
to an emergency, and even how secure code in applications and

8. websites is.User policies must cover all aspects of how the user
is expected to use company technology. In some cases, such as
instant messaging and web use, policies may be difficult to
enforce, but that does not change that they must still be in
place. If your user policies fail to cover a particular area of
technology use, then you will have difficulty taking any action
against any employee who performs that particular misuse.
© 2016 Pearson, Inc. Chapter 10 Computer Security
Policies
*
*
*
Explain what cyber terrorism is and how it has been used in
some actual cases.
Understand the basics of information warfare.
Have a working knowledge of some plausible cyber terrorism
scenarios.
Have an appreciation for the dangers posed by cyber terrorism.
*
Cyber terrorism, according to the definition of the FBI:
Premeditated, politically motivated attack against information,
computer systems, computer programs, and data that results in
violence against noncombatant targets by subnational groups or
clandestine agents.
Typically, loss of life in a cyber attack would be less than in a
bombing attack.
*
All these could lead to significant deaths: train wrecks, hospital
deaths, loss of air traffic control resulting in plane crashes, and
so forth.
*
All these could lead to significant deaths: train wrecks, hospital

9. deaths, loss of air traffic control resulting in plane crashes, and
so forth.
*
All these could lead to significant deaths: train wrecks, hospital
deaths, loss of air traffic control resulting in plane crashes, and
so forth.
*
All these could lead to significant deaths: train wrecks, hospital
deaths, loss of air traffic control resulting in plane crashes, and
so forth.
*
Bring your own device (BYOD) has become a significant issue
for most organizations. Most, if not all, of your employees will
have their own smart phones, tablets, smart watches, and Fitbits
that they will carry with them into the workplace. When they
connect to your wireless network, this introduces a host of new
security concerns. You have no idea what networks that device
previously connected to, what software was installed on them,
or what data might be exfiltrated by these personal devices.
*
*
*
All these could lead to significant deaths: train wrecks, hospital
deaths, loss of air traffic control resulting in plane crashes, and
so forth.
*
*
*
*
*