1. Figure 11-5: Control Principles
Policies
Brief visions statements
Cannot give details because the environment and technology keep changing
Standards
Mandatory actions that MUST be followed
Baselines
The application of standards to specific products
For example, steps to harden a LINUX server

2. Figure 11-5: Control Principles
Guidelines
Voluntary recommended action
Although voluntary, must consider in making decisions
Good when the situation is too complex or uncertain for standards
Unfortunately, sometimes should be standards but lack of political power prevents this

3. Figure 11-5: Control Principles
Procedures
Sets of action taken by people
Steps to do background checks on employees
Steps to add user on a server

4. Figure 11-5: Control Principles
Employee Behavior Policies
For general corporate employees
Theft, sexual harassment, racial harassment, pornography, personal use of office equipment, revealing of trade secrets, etc.

5. Figure 11-5: Control Principles
Best Practices and Recommended Practices
Best practices are descriptive of what the best firms do
Recommended practices are prescriptions for what the firm should do
Both allow a firm to know, at a broad level, if it is doing what it should be doing

6. Figure 11-6: Operations Security
The day-to-day work of the IT department and other departments
Systems administration (server administration) especially
Entering data, upgrading programs, adding users, assigning access permissions, etc.

7. Figure 11-6: Operations Security
Principles
Clear roles
Who should do what in each step
Assign tasks to roles, then assign individuals to roles as needed

8. Figure 11-6: Operations Security
Principles
Separation of duties and mandatory vacations to prevent people from maintaining deceptions
Prospects for collusion: Reduce them
Check family and personal relationships assigning people to duties

9. Figure 11-6: Operations Security
Accountability
Accountability and roles
Owner: Responsible for the asset
Custodian: Delegated responsibility
Auditable protections and controls for specific assets
If not auditable, can you tell if they work?
Exception handling with documentation and audit of who took what actions

10. Figure 11-6: Operations Security
Managing Development and Change for Production Servers
Tiers of Servers
Development Server: Server on which software is developed and changed
Developers need extensive permissions
Staging (Testing) Server: Server on which changes are tested and vetted for security
Testers should have access permissions; developers should not

11. Figure 11-6: Operations Security
Managing Development and Change for Production Servers
Tiers of Servers
Production Servers: Servers that run high- volume production operations
Neither developers nor testers should have access permissions

12. Figure 11-6: Operations Security
Managing Development and Change for Production Servers
Change Management Control
Limit who can request changes
Implement procedures for controlling changes
Have security examine all candidate changes for potential problems (bad encryption, lack of authentication, etc.)

13. Figure 11-6: Operations Security
Managing Development and Change for Production Servers
Auditing Development for individual programs
Do detailed line-by-line code inspection for security issues