Topics in this domain
- Security Governance and Roles
- Data Classification and Ownership
- Security Policies
- Privacy Principles and GDPR
- Identity Management
- Authentication Factors
- Biometrics
- Access Models: DAC, MAC, RBAC
- Logical and Privileged Access
- Cryptography Basics
- Symmetric Encryption
- Asymmetric Encryption
- Hashing and Integrity
- Digital Signatures
- PKI and Certificates
- Firewalls
- IDS/IPS
- VPN, SSL/TLS, IPsec
- Wireless Security
- Endpoint and Mobile (BYOD)
- Cloud and Virtualization Security
- Physical Access Controls
- Environmental Controls: Fire, Power, HVAC
- Social Engineering
- Malware
- Network Attacks: DoS, Spoofing, Sniffing
- Application Attacks: SQLi, XSS
- Vulnerability Management and Pen Testing
- Incident Response
- Digital Forensics and Chain of Custody
- Security Awareness Training
- Logging, SIEM, and Auditing Security
Security Policies
House rules
A gym has house rules. Members sign them when they join, staff explain them, and there are consequences for breaking them. A rule pinned to the wall that nobody follows or enforces isn’t really a rule.
Security policies are management’s house rules for information. They only matter if they’re known, followed and enforced.
Policies say what and why, and stay technology-neutral. Specific settings (“passwords at least 14 characters”) belong in standards; step-by-step instructions belong in procedures.
The top-level policy
The information security policy is management’s statement of direction and commitment. It typically covers:
- the objectives and scope of information security
- management’s commitment and support
- roles and responsibilities
- key principles: a risk-based approach, classification, least privilege, segregation of duties
- the framework of supporting policies and standards
- compliance monitoring, the exception process, and the consequences of breaking the rules
- who owns it and how often it’s reviewed
It’s approved by senior management (or the board), not just the CISO, and communicated to all staff. It’s usually the first document an auditor reviews in a security audit.
Supporting policies
| Policy | Purpose |
|---|---|
| Acceptable use | Rules for using systems, email, internet and devices; usually signed at hiring |
| Access control | How access is requested, approved, reviewed and removed |
| Data classification and handling | Classification levels and handling rules |
| Password / authentication | Authentication requirements (details in a standard) |
| Remote access and mobile devices | Home working, VPN, BYOD |
| Incident response | What must be reported, and how |
| Third-party security | Requirements for suppliers and service providers |
| Backup, logging, cryptography | Supporting technical areas |
Making policies work
- Communicate and acknowledge: staff receive the policy and confirm they understand it.
- Train: awareness programmes explain what policies mean in everyday work.
- Enforce: technical controls implement policy wherever possible, and breaking the rules has consequences.
- Manage exceptions: formally requested, risk-assessed, approved, time-limited and tracked.
- Review: at least annually, and after significant changes.
Auditing policies
The auditor checks that policies:
- exist for key areas and are approved at the right level
- are current and reviewed
- are communicated and acknowledged
- are consistent with standards and procedures
- are actually followed, by testing compliance rather than just reading the document
Example. The acceptable use policy forbids storing company data in personal cloud accounts. Network logs show large uploads to personal storage services every week, with nothing blocking or monitoring them. The policy exists but isn’t enforced, so the auditor recommends technical controls such as a cloud access security broker and blocking rules.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who approves the information security policy | Senior management |
| Best evidence policy is effective | Compliance testing shows it’s followed |
| Document users sign at hiring | Acceptable use policy |
| Policy exceptions | Formal, risk-assessed, approved, time-limited |
| First document to review in a security audit | The information security policy |
In short
- The information security policy states management's intent, objectives and responsibilities for security, and is approved by senior management.
- Supporting policies cover topics such as acceptable use, access control, data classification, remote work, incident response and third parties.
- Policies must be communicated, acknowledged by staff, enforced and reviewed periodically.
- Acceptable use policies set rules for users and are typically signed at onboarding.
- Exceptions follow a formal process with risk assessment, approval and expiry.
- The auditor checks existence, approval, currency, communication and actual compliance.
Exam traps
- A policy without enforcement or monitoring has little effect.
- Security policy should be approved by senior management, not just the CISO.
- Policies should be technology-neutral; specific settings belong in standards.
- The first document an auditor typically reviews in a security audit is the security policy.
Slides
Click the slide and use the arrow keys. F toggles full screen.
House rules
A gym has house rules: members sign them when they join, staff explain them, and there are consequences for breaking them. A rule pinned to the wall that nobody follows or enforces isn't really a rule.
Security policies are management's house rules for information. They only matter if they're known, followed and enforced.
Making policies work