All language subtitles for 007 Security Governance Policies, Standards and Procedures_en

We are now going to discuss some key components of security governance. These components are important

in order to ensure a decent and secure security posture of organisations. Mainly, we will be discussing

policies, standards and procedures.

We're going to have a look at what do these entail and what are the differences between them.

If you look at the security governance pyramid, we have policies at the top.

Now policies are organisation wide, they are high level and broad natured in scope. Usually policies

are defined for long term and they span several years typically. Policies defined responsibilities both

for management and the users.

Now policies are few in number, they're high level and broad-natured.

But then we have standards which highlight the rules which are needed to achieve the intent of the policy.

So standards would be more in number compared to policies.

And just below standards, we have procedures which are basically specific steps needed to realize the

rules specified by the standard. Now the basic aim of procedures, is to train employees and ensure

consistency in security related business processes.

What it means is that if you have a standard operating procedure and you have documents which lists

the specific steps needed to be taken in a particular situation, then it doesn't matter which employee

is implementing those steps.

You'll have a consistency of results and a consistency of process.

This is very important because if you don't have standard operating procedures, then different employees

are going to take different routes.

They may take different steps, which may lead to different results. So consider

for example, there is a phishing attack on your organization that has been detected.

If you have proper procedures, how to address that phishing attack starting from step one to the last

step, then you will be in a better position to ensure the sanctity of your security posture.

We also have guidelines which basically reside at the same level of the pyramid as procedures. Guidelines

are optional recommendations, which means that they are suggested best practices, but not mandatory.

In order to have a clear understanding about what policy standards and procedures entail, what are

the differences between them and how to structure them, we can take the example of passwords and we'll

design the policy, the standard and procedures.

So the password policy states that passports must be strong, they should be regularly rotated and users

are responsible for safeguarding their passwords.

If you notice, the policy is quite broad and generic in nature and specific things are not mentioned.

So, for example, they've said passwords must be strong.

Now, this is a general statement.

They have not specified how strong or how to select strong passwords.

It is also not mentioned that how regularly should they be rotated and so on.

So it's broad and general in nature.

Let's have a look at password standard.

Now, the password standard can specify things like password should be greater than eight characters

in length and should have two special characters.

Now this standard basically explains more details about passwords must be strong.

So in order to make them strong, we need to make sure that they are greater than a specific length

and then they have special characters, for instance.

The second point is that passwords must be changed every 90 days.

So our policy stated that the passwords should be regularly rotated, but it is now the standard which

is specifying that the rotation should be done every 90 days.

So it's providing more details.

Thirdly, users are responsible for their passwords and in case they believe it has been compromised,

they must immediately contact I.T. security.

Now, this part of the standard explains and provide more details about how users are responsible for

safeguarding their passwords and what are their responsibilities in case they believe their password

has been compromised.

Now, let's have a look at procedures and guidelines which provide specific steps that must be taken.

So, for example, let's consider a password change procedure. So it lists the specific steps that you

need to do.

For example, you need to log into your account.

You need to go to option settings and select change password.

Then you have to enter the new password along with confirmation and click submit.

Now, it does seem that these are very simple steps and, you know, people can actually do them on

their own.

But it is always nice to provide a standard set of steps in order to avoid confusion.

Now, this is a simple example, but in some instances, for example, addressing a security breach,

things can get out of hand

if we don't have a streamlined set of procedures. Now password guidelines could be something along the

lines of select a phrase as password as it is easy to remember and strong.

And this is true because if you select a sentence or phrase as password, the sheer length of that is

going to make the password very strong and almost impossible to attack through brute force.

So as we saw policies that provide overall direction.

And then we have standards which basically allow us to explain policies in more detail, and then we

have procedures which lists specific steps that you need to take.

Designing effective information security policies is a difficult task and there are a number of challenges

which must be addressed.

Let's have a look at some of the key things that you must take into consideration if you want to design

an effective information security policy.

So the first one is risks. You should always clearly identify risks, their possibility of occurrence and

prioritize them.

So the key danger here is that if you miss the risk, especially one that is likely to materialize,

then your information security policy would have a serious flaw.

So next are legal and regulatory requirements. So every industry has its own set of legal and regulatory

compliance requirements, and when designing your information security policies, those requirements

must be properly addressed.

Any information security policy without teeth is pretty much useless, so your policy should clearly

identify instances which are considered as violations and the penalties associated with those, and

then you should also make sure that those penalties are enforced.

You should always take people on board, especially the staff, which would be abiding by your security

policy day in and day out.

They can even help streamline the policy and they can sometimes identify areas or issues that might

have been overlooked.

You can have the best information security policy in the world, but if your employees are not properly

trained on how to implement it, then it's pretty much useless.

So you should always make sure that you conduct periodic training workshops in which you share the information

security policy rules and make your employees aware of them.

Finally, you should always have management support and the support should not be verbal

be written and it needs to be visible.

So if the employees, they see senior management owning a security policy and recommending it, then they

are more likely to follow it.

So this concludes our lecture.

I'll see you in the next one.