- [Instructor] Every organization approaches
security policies a little bit differently.
The details of an organization's policy will vary
depending upon several factors,
including the culture of an organization.
For example, an organization with a relaxed,
empowering culture might have very few policies
that don't contain detailed security restrictions.
The details of security policies also depend upon
the industry that the organization is in.
For example, healthcare providers will likely
have greater control around data privacy
than a publishing company would.
Regulations also play a role.
Organizations that process credit cards, for example,
will have a large number of policies dictated
by the Payment Card Industry Data Security Standard,
PCI DSS.
That said, there are several standard policies
that every organization should have
in order to provide the foundation
for its information security program.
These are an information security policy, a privacy policy,
and an acceptable use policy.
The information security policy sets the tone
for the organization's entire information security program.
This policy may be long or short
and the contents will vary from organization
to organization,
but the policy should have several common elements.
First, it should contain a clear designation
of a specific individual who will be responsible
for information security matters.
This doesn't need to include the name of that person.
What you usually do is assign the responsibility to a role,
such as the Chief Information Security Officer,
otherwise known as the CISO.
The information security policy should also include
descriptions of the roles that managers, employees,
and other users play in information security.
You should see a requirement the organization
follow security standards
as well as the delegation of the authority
to create those standards to an IT group
or other entity.
The policy should describe the authority granted
to individuals responding to a security incident,
and it should include a process for handling violations
and exceptions to the policy.
The organization should also have a published privacy policy
that covers the ways that the organization collects, stores,
and shares information about individuals.
If we take a look at the Linkedin Privacy Policy,
you'll see that it contains several sections,
an introduction that explains the overarching principles
included in the policy,
a section that describes the types
of information collected by the organization,
one that includes how they will use personal information
that they collect,
a section on an individual's choices
and obligations under the policy,
and other important information.
One of the key elements of this policy is
that it's written in very clear language.
On the right side, you see the detail legalese
that's required by lawyers,
but on the left side, you see a very clear,
plain English explanation
of what this long section actually means.
This is really a great way to do privacy policies
because it provides the legal language
that protects the organization,
while also providing a very clear way
for users to understand what their agreeing
to when they join this website.
The third policy that should exist in
every organization's policy repository
is an acceptable use policy,
sometimes also called a responsible use policy.
This policy states the organization's expectations
for how employees will use information systems.
For example, an acceptable use policy
should clearly prohibit illegal activity
or activity that would reflect poorly upon the organization.
It should also describe what, if any,
personal use of computing resources is acceptable.
These policies should also explain
how the organization implements several key principles
of information security.
Let's take a look at four of those principles.
The principle of least privilege states
that an individual should have only the minimum set
of permissions necessary to complete his or her job.
Granting excess permissions increases security risk
by creating the possibility of unauthorized activity.
The principle of separation of duties says
that an organization should separate
critical business functions into separate permissions
that are never granted to the same individual.
For example, no single person should have both
the permission to create a new vendor
in the accounting system
and the authority to issue a check to a vendor.
If a single employee had both of these permissions,
it would be easy for him or her
to create a fake vendor
and then issue checks to that fake vendor in an attempt
to steal funds from the organization.
The practice of mandatory vacations requires
that key employees take at least one,
and preferably two, weeks of consecutive vacation each year
during which his or her system access
is temporarily suspended.
The idea behind this principle is
that fraud may come to light when the employee is unable
to continue actions that cover it up
during this extended absence.
Finally, the practice of job rotation
serves a purpose similar to mandatory vacations.
Instead of forcing users to take vacations to detect fraud,
the job rotation principle says
that personnel in sensitive positions
should rotate periodically
so that they would not retain the ability
to continue covering up fraudulent activity.