Hi everyone.
And welcome back to my course on Enterprise Security fundamentals.
In this section I want to talk about developing and maintaining policies.
So let's get an overview of what we're going to discuss.
Organizations should not approach information security in a in an ad hoc manner.
One way of ensuring that an organization's approach to information security is deliberate implant is
to document rules and procedures as organizational policies organizational policies can provide stakeholders
within the organization with clarity about not only how sensitive information is to be protected but
which people within the organization are responsible for configuring and maintaining the controls that
provide that protection if there aren't policies that specify what responsibilities exist.
When it comes to the security of information systems it's possible both that some individuals may perform
actions in the service of securing information systems that exceed what would be on further consideration
to be acceptable and other individuals may take minimal action to protect the information systems because
their responsibility for those system isn't clearly delineated.
For example there have been scenarios where administrators of security systems have refused to hand
over administrative account passwords to superior when requested.
In some cases are this is because the administrators of those systems believe that doing so would compromise
the security of those systems.
In other cases it was because the administrator of those systems had reason to believe that the superior
was attempting to circumvent the security controls of those systems a clearly defined policy would spell
out when such a request should be honored and when such a request should be refused policies that clearly
delineates responsibilities assist organizations that are under attack because they spell out which
individuals in a crisis should perform tasks and how those tasks should be performed if responsibilities
are not clearly delineated.
It's possible that mistakes could be made in responding to the attack that lead to more severe consequences.
Policies should be developed in conjunction with all the stakeholders.
Your organization may be subject to specific regulations around data breaches.
This regulations may determine which people within an organization are responsible for performing specific
actions when a breach occurs.
For example that the CIO or the organization's compliance officer must report the breach to a specific
authority within 48 hours of a breach being detected.
At no let's talk about a little bit about the processes so the processes that an organization should
follow when maintaining an information security posture are like those outlined in the blue team kill
chain section.
From the previous section these processes can be categorized as follows.
Pre incident processes and the pre incident process essentially involves maintaining the organization's
ongoing baseline security posture the pre incident process represents the organization's default security
stance.
Right.
So this means ensuring that existing organizational policies and procedures are followed which include
an effective batch management strategy because most breaches could have been prevented if organizations
kept their information systems up to date with vendor patches and update.
It should also include effective monitoring and alerting ensure that the appropriate telemetry is being
generated by the information systems and that this telemetry is effectively analyzed for anomalies that
may indicate an intruders presence only and effectively calibrated monitoring and alerting system can
work in an organization that an incident is occurring.
The incident process should also include ensuring good administrative practices ensuring good administrative
practice such as only using privileged access workstations or just an off administration privileged
access management list privilege and other techniques of limiting the usage of administrative rights
reduces the chance of an attacker successfully leveraging privilege escalation should they gain a foothold
within the organizational infrastructure.
The next thing it should include is restricting possibility of lateral movement configure information
systems so that the possibility of an intruder moving laterally through those systems is minimized.
This can be accomplished by implementing and maintaining effective code integrity policies as well as
ensuring that networks are segmented so that only necessary communication between hosts can occur.
Another thing the president process should include is ensure good data classification and protection
practices configure automatic classification mechanisms that apply classification labels to data as
that data is generated and automatic protection system that secure that data based on the assigned classification
label last but not least a pre incident process should include performing Grant team exercises on a
regular basis when not under attack by an intruder perform regular intrusion drills to ensure that the
information security staff and appropriate stakeholders are well versed in how to react when an intrusion
occurs.
The next process on our list is intra incident process after considering their information security
posture and performing regular red team exercises.
Organizations should develop clear policies and procedures on how to react when an intruder is detected
in organizational information systems described in more detail in the previous modules and lessons we've
we've been through.
This should include determine the extent of the compromise so determine the degree to which the intruder
has infiltrated the organization's information systems perform a detailed and thorough investigation
to assert and which systems the intruder has compromised who how those systems were compromised and
when those systems were compromised.
But then of course plan a response ensure that the attempt to evict the intruder from the organizational
systems only occurs after the extent to which the intruder has compromised the organization is determined
right developing and then implementing an effective response gives an intruder less latitude to react
than attempting to deal with the intruder on an ad hoc basis before the full extent of the intrusion
has been determined.
In most cases the intruder has been present on the network for some time before being detected.
So spending extra time determining the extent of the compromise and planning a response will not impact
on the overall severity of the breach and then enact the response was the plan to respond to the intruder
has been developed.
It should be enacted enacting the response should not only involve evicting the intruder from the organizational
network but remediating the vulnerabilities that allowed the intruder to gain access to the network
in the first place and the last process on our list is the post incident process the post incident process
should involve further investigation as to the how the where and the when and the possibility of the
white of the intrusion.
It should involve an analysis of what was lacking in the implementation of the baseline security posture
that allowed the intruder to gain access to the network.
Was this analysis has been performed steps should be taken to improve the policies and procedures involved
to minimize the chance that the intruder will be successful in the future.
Next on I want to talk to you about an important aspect of the policies and procedures and processes
I included it in the processes.
Slide here.
So this is disclosure responsibility post breach activity doesn't stop once the configuration vulnerabilities
that were leveraged to perform the intrusion are remediated an increasing amount of legislation and
regulation dictates that organizations must inform certain stakeholders if a breach occurs not only
not only must information systems be remediated but appropriate notifications must be made.
For example in the United States for example the health and insurance portability and accountability
act shortly hip hop requires that the affected individuals.
The US Department of Health and Human Services and in some cases the media be notified if protected
health information.
B be exposed through a breach.
On the other hand the European General Data Protection Regulation.
The famous GDP are requires notification of both the supervisory authority generally a member of the
state government agency and affected data subjects when there is a breach of security leading to the
accidental or unlawful destruction loss alteration unauthorized disclosure of or access to personal
data transmitted stored or otherwise processed and I and the quote this notification must be provided
again I'm quoting without undue delay and where physical not later than 72 hours after having become
aware of it and I end the quote again in many other jurisdictions state data breach laws mandate that
impacted parties must be notified if the information exposed could lead to fraud or identity theft.
An increasing part of the information security professionals rule isn't simply to ensure that information
systems are protected in the most technically competent manner possible but is as well as to ensure
that regulations around the protection of data and systems as well as how an organizations must respond
to a breach must be followed.
As mentioned earlier internal organizational policies should specify which personnel are responsible
for specific areas.
This not only includes who is responsible for maintaining the security of a specific system and data
but who is responsible for crafting the notifications to the external parties impacted by the intrusion.
And that concludes our final section of discourse.
Ah what I'd like you to do is go on to the next section where you will find the final exam the final
exam is composed of questions from all the sections and lessons of this course and it has let's see
a passing a passing grade of 70 percent correct answers.
This will test your
overall knowledge which you have gained throughout the course and your familiarity with all the concepts
discussed in this course.
After that I hope you will join me in the next course of the series.
As I've said and as you might have read in the presentation of the course this will be a series of mind
courses and the next course will be a fabulous course of great course which will address detecting breach
early.
This is the title I gave it.
But what is it about.
It's about detecting mechanisms responding to security alerts and so on.
That course will also include a hands on lab where we will implement things like Microsoft 88.
We will perform a tax credential theft tax golden ticket a tax using several tools such as Mimi Katz
metal plate and several other tools that will also have a lab and the lesson in which I will guide you
step by step on how to build your virtual lab to be able to perform all the tasks tasks.
Sorry that I will perform in the course.
I hope this course has been of a great help to you and I hope that you have gained.
The necessary knowledge about the basic concepts of security in an enterprise and I also hope that you
will join me in the next course of the series.
I hope this has been informative for you.
And thank you for watching.