5.1 Security Standards

Question 1

Security standards

Answer 1

• A formal definition for using security technologies
  and processes
  –Complete documentation reduces security risk
  –Everyone understands the expectations
• These may be written in-house
  –Your requirements may be unique
• Many standards are already available
  –ISO (International Organization for Standardization)
  –NIST (National Institute of Standards and Technology)

Question 2

Password

Answer 2

• What makes a good password?
  –Every organization has their own requirements
  –Create a formal password complexity policy
• Define acceptable authentication methods
  –No local accounts, only LDAP to the AD database, etc.
• Create policies for secure password resets
  –Avoid unauthorized resets and access
• Other password policies
  –Password change frequency, secure password storage
  requirements, password manager options, etc.

Question 3

Access control

Answer 3

• How does an organization control access to data?
  –Determine which information, at what time
  –And under which circumstances
• Define which access control types can be used
  –No discretionary, mandatory only, etc.
• Determine how a user gets access
  –Require privilege documentation
• Document how access may be removed
  –Security issue, expiration, contract renewals, etc.

Question 4

Physical security

Answer 4

• Rules and policies regarding physical security controls
  –Doors, building access, property security
• Granting physical access
  –Different for employees vs. visitors
• Define specific physical security systems
  –Electronic door locks, ongoing monitoring,
  motion detection, etc.
• Additional security concerns
  –Mandatory escorts, off-boarding, etc

Question 5

Encryption

Answer 5

• Define specific standards for encrypting and
  securing data
  –All things cryptographic
  –Can include implementation standards
• Password storage
  –Methods and techniques
• Data encryption minimums
  –Algorithms for data in use, data in transit,
  data at rest
  –Will probably be different for each state