Information Security Policy (CISSP Free by Skillset.com)

Summary

This module delves into the creation of information security policies, emphasizing the importance of aligning with laws, regulations, and best practices. It outlines the development process, starting with organizational policies and moving to functional policies, standards, procedures, and guidelines. The National Institute of Standards and Technology's (NIST) Special Publication 800-12 is highlighted for its guidance on IT security. The necessity for clear, written policies and procedures for compliance and employee accountability is stressed, distinguishing between different policy types and their purposes in ensuring organizational security.

Takeaways

• 📜 The module focuses on the creation of information security policies, procedures, standards, baselines, and guidelines.
• 🏛️ Developing policies should begin with considering laws, regulations, and industry best practices as foundational drivers.
• 🛡️ Organizational policy is a management statement on security, which is essential before working on functional policies.
• 📋 Functional policies address specific business and system security issues and are derived from management's directives.
• 📚 The National Institute of Standards and Technology (NIST) publication 8-12 provides guidance on information technology security.
• 📝 Management's responsibility is to create a computer security program and assign necessary roles and responsibilities.
• 🔒 Policies should include compliance issues, security, privacy, and acceptable use policies for organizational security.
• 📘 Information security success depends on clear, understandable, and universally implemented security policies.
• 📊 ISC² certifications emphasize the importance of written plans, procedures, and policies for security management.
• 👥 Clear responsibilities for employees and detailed step-by-step procedures are crucial for ensuring compliance.
• 🚫 Types of policies include regular, advisory, and informative, each serving different purposes within an organization.
• 🔑 Standards, baselines, and procedures are mandatory and binding, dictating expected behaviors and minimum security levels.
• 📍 Guidelines are non-binding and serve as operational guides, providing recommended actions for employees.

Q & A

What is the primary focus of the information security policy module?

The primary focus of the information security policy module is to discuss policies, procedures, standards, baselines, and guidelines in the context of information security.

What should be the starting point when developing policies and procedures for information security?

The starting point should be looking at laws and regulations that the industry is required to follow and considering best practices as the drivers for policy development.

What is the role of organizational policy in information security?

The organizational policy serves as management's statement on security, providing the foundation upon which functional policies, standards, procedures, baselines, and guidelines are developed.

What does the National Institute of Standards and Technology (NIST) provide to assist with information technology security?

NIST provides Special Publication 800-12 to help with information technology security, which describes the need for computer security based on laws, regulations, the desire to avoid liabilities, and best practices.

What are the components of an information security policy as discussed in the script?

The components include compliance issues, the SECCI (Security, Education, Compliance, Control, and Investigation) model, and organizational policies such as internet policy, privacy policy, and acceptable use policy.

Why is it important for information security policies to be easy to understand and implemented throughout the organization?

It is important because without clear and well-implemented security policies, an organization will not be successful in providing information security.

What does the ISC² certification emphasize regarding policies, procedures, and plans?

ISC² certifications emphasize the importance of having written plans, procedures, and policies, with clear responsibilities for employees and step-by-step procedures to ensure compliance.

What is the difference between regular policies and advisory policies in the context of information security?

Regular policies ensure compliance with industry regulations and are often detailed, while advisory policies advise against unacceptable behavior, provide prohibited regulations, and outline punishments for noncompliance.

How are organizational standards different from baselines and procedures in information security?

Organizational standards are binding and dictate how hardware and software should be used and the expected behavior of employees. Baselines are mandatory and define a minimum level of security required on all devices. Procedures are also mandatory and provide detailed step-by-step actions for users.

What is the role of guidelines in information security policies?

Guidelines are not binding or mandatory; they serve as operational guides and provide employees with recommended actions to follow.

For the CISSP exam, why is it important to distinguish between standards, baselines, procedures, and guidelines?

It is important to distinguish between them because standards, baselines, and procedures are all mandatory, while guidelines are not and are meant to be a simple guide for employees to follow.