Figure 11-5: Control Principles Policies Brief visions statements Cannot give details because the environment and technology keep changing Standards Mandatory actions that MUST be followed Baselines The application of standards to specific products For example, steps to harden a LINUX server

Figure 11-5: Control Principles Guidelines Voluntary recommended action Although voluntary, must consider in making decisions Good when the situation is too complex or uncertain for standards Unfortunately, sometimes should be standards but lack of political power prevents this

Figure 11-5: Control Principles Procedures Sets of action taken by people Steps to do background checks on employees Steps to add user on a server

Figure 11-5: Control Principles Employee Behavior Policies For general corporate employees Theft, sexual harassment, racial harassment, pornography, personal use of office equipment, revealing of trade secrets, etc.

Figure 11-5: Control Principles Best Practices and Recommended Practices Best practices are descriptive of what the best firms do Recommended practices are prescriptions for what the firm should do Both allow a firm to know, at a broad level, if it is doing what it should be doing

Figure 11-6: Operations Security The day-to-day work of the IT department and other departments Systems administration (server administration) especially Entering data, upgrading programs, adding users, assigning access permissions, etc.

Figure 11-6: Operations Security Principles Clear roles Who should do what in each step Assign tasks to roles, then assign individuals to roles as needed

Figure 11-6: Operations Security Principles Separation of duties and mandatory vacations to prevent people from maintaining deceptions Prospects for collusion: Reduce them Check family and personal relationships assigning people to duties

Figure 11-6: Operations Security Accountability Accountability and roles Owner: Responsible for the asset Custodian: Delegated responsibility Auditable protections and controls for specific assets If not auditable, can you tell if they work? Exception handling with documentation and audit of who took what actions

Figure 11-6: Operations Security Managing Development and Change for Production Servers Tiers of Servers Development Server: Server on which software is developed and changed Developers need extensive permissions Staging (Testing) Server: Server on which changes are tested and vetted for security Testers should have access permissions; developers should not

Figure 11-6: Operations Security Managing Development and Change for Production Servers Tiers of Servers Production Servers: Servers that run high- volume production operations Neither developers nor testers should have access permissions

Figure 11-6: Operations Security Managing Development and Change for Production Servers Change Management Control Limit who can request changes Implement procedures for controlling changes Have security examine all candidate changes for potential problems (bad encryption, lack of authentication, etc.)

Figure 11-6: Operations Security Managing Development and Change for Production Servers Auditing Development for individual programs Do detailed line-by-line code inspection for security issues