Security Policies - CompTIA Security+ SY0-701 - 5.1

Understanding Security Policies and Their Importance

The CIA Triad: Confidentiality, Integrity, Availability

• The primary goal of security administrators is to establish the CIA triad—Confidentiality, Integrity, and Availability—through rules or policies that everyone must follow.

• Security policies can range from broad goals like data storage requirements to detailed regulations on Wi-Fi usage and remote access protocols.

Role of Security Policies

• Detailed information security policies serve as a master list for maintaining network uptime and security; they are essential for organizational compliance.

• In some organizations, these policies are mandatory rather than optional, guiding responses to various security incidents such as virus detection or unauthorized access attempts.

Acceptable Use Policies (AUP)

• AUP defines acceptable technology use within the organization, covering computers, mobile devices, etc., serving both informative and legal protection purposes.

• Documentation of AUP helps justify actions taken against employees who violate these guidelines.

Business Continuity Planning

• Organizations need business continuity plans to manage situations where technology becomes unavailable; this includes manual transaction processes in retail scenarios.

• Effective business continuity requires pre-planning and extensive documentation/testing to ensure readiness during disasters.

Disaster Recovery Plans

• Disaster recovery plans address various potential disasters—natural events, system failures, or human-created issues—and outline recovery strategies for affected operations.

• These plans should include provisions for alternative recovery locations and methods for data restoration following incidents.

Incident Response Procedures

• Organizations must have documented procedures for handling different types of security incidents such as malware infections or DDoS attacks.

Security Incident Policies and Response Teams

Importance of Security Incident Policies

• Organizations need a set of security incident policies to effectively respond to security incidents.

• A specialized team, known as the incident response team, is essential for handling various types of security events.

Roles in Incident Response

• The incident response team consists of trained individuals prepared for any security event.

• IT security management teams are crucial for acquiring necessary resources and personnel during incidents.

• Compliance officers ensure that data and systems meet regulatory requirements during incidents.

User Community Involvement

• The user community can provide valuable insights regarding observed events during a security incident.

NIST Guidelines on Incident Handling

Overview of NIST Special Publication 800-61 Revision 2

• This document, titled "The Computer Security Incident Handling Guide," outlines a comprehensive response lifecycle for security incidents.

Key Phases in the Response Lifecycle

• Preparation before an incident occurs.

• Detection and analysis of the incident.

• Containment, eradication, recovery processes, and post-incident activities.

Software Development Lifecycle (SDLC)

Purpose and Structure of SDLC

• The Software Development Lifecycle (SDLC) guides the process from idea generation to application deployment.

Stages in SDLC

• Involves creating requirements, collaborating with end users, developing applications, testing them, and deploying within budget and schedule constraints.

Common Application Development Lifecycles

Waterfall Model

• A linear approach starting with requirements followed by development, testing, deployment, and maintenance phases.

Agile Model

• A faster iterative process involving continuous design, development, testing, deployment, and review cycles until final launch.

Change Management Processes

Importance of Change Management

• Every organization should have a structured change management process to handle updates or modifications effectively.

Components of Change Management

• Ensures changes do not negatively impact organizational operations; includes documentation on frequency and duration of changes.

Risks Associated with Poor Change Management