Having the greatest policies in the world will not do you any good if no one knows about them and follows them. It is important to educate users and administrators on the proper responses to common policy requirements. This section will cover the following topics:
- Security policy training and procedures
- Personally identifiable information (PII)
- Information classification: Sensitivity of data (hard or soft)
- Data labeling, handling, and disposal
- Compliance with laws, best practices, and standards
- User habits
- Threat awareness
- Use of social and P2P networking
Security Policy Training and Procedures
Users must be made aware of policies that directly impact them. An acceptable use policy will not impact the behavior of anyone who is not aware of it. Users should undergo frequent security policy training and understand related procedures.
A good practice is to have frequent (usually annual) security-related awareness training, and to have users sign a user agreement. This leaves no doubt as to the expectations of user conduct. Keeping users aware of and compliant with security policies minimizes the organizational risk posed by users.
Personally Identifiable Information (PII)
Personally identifiable information (PII) is just what it sounds like: any information that personally identifies an individual. This information is not limited to private medical, legal, or financial data. Any documents that contain two or more personal identity items, such as a person’s birthday, full name, or social security number, are considered having PII.
Usually, those who have to access documents or other data containing PII have the principle of least privilege applied to them. Access to PII should be limited to those with a legitimate need to access the data, and the access should be logged in case of misuse.
Information Classification: Sensitivity of Data (Hard or Soft)
Not all data is created equal. Some data is more sensitive than other data. Data may be available to anyone internal to the organization, may be shared with third parties, or may be available only to the board of directors.
For soft data, or data without a physical presence, such as database entries or other computer files, access can be controlled with user rights and permissions. For very sensitive data, encryption may be used to ensure that only specific people can access it and that they are unable to disseminate it. For hard data, such as printouts or a physical copy of information, access to sensitive data must be controlled physically.
Data Labeling, Handling, and Disposal
When it comes to sensitive data, how will your users distinguish between sensitive data that must be controlled and public information that does not require protection? The answer is any media that contains confidential data should be documented and labeled. If the data is soft, the indication can be made in the file itself. If it is a hard copy of the data, it can be clearly marked.
Whether the data is in hard or soft format, the location of sensitive data and changes to its location or content should always be recorded in an accurate log. There are often record-keeping requirements regarding sensitive data, such as a prescribed length of time medical or financial records must be maintained. For sensitive data that must be kept until an expiration date, controls should be put in place to prevent the accidental destruction of the data.
For data that must be kept confidential, it is important to track not just the original confidential data, but any copies or backups that are made. To reiterate, all confidential data should be labeled, cataloged, and tracked until disposal.
Compliance with Laws, Best Practices, and Standards
There are many levels of good ideas when it comes to policies and procedures, from something that tends to make things run smoothly to practices required by law. It is important for companies to have compliance with laws, and follow best practices and standards.
When a certain policy or practice is required by law, it is known as a compliance law. Some well-known compliance laws are Sarbanes-Oxley and HIPAA. Different industries may have different compliance requirements. Failing to conform to compliance laws may have severe penalties, including fines and/or jail time.
Best practices and standards are good ideas that, while not mandated by law, are nonetheless expected of systems. These can be defined generally and casually (e.g., make backups of important information) or specifically and formally (e.g., IEEE standards regarding network wiring). Audits conducted to ensure an organization is meeting compliance laws and industry standards are collectively known as compliance audits.
User Habits
User behavior and training, or user habits, are an integral component of threat mitigation. Users should be trained to know many common errors and the risks associated with them.
Password behaviors – Users should not keep passwords at their desk or at any other insecure location. Passwords should be memorized or physically secured.
Password masking – The risk of unauthorized knowledge of passwords can also occur via “shoulder-surfing.” This refers to the act of reading a password over the shoulder of a user entering his or her password. Users should be aware of shoulder surfing and taught to protect their computer password in the same way they protect their ATM PIN. Shoulder surfing attacks can be partially mitigated by masking passwords, a process by which the actual password displayed is a series of asterisks.
Password expiration – Password expiration helps to limit the term of exposure in the case that an account password becomes compromised. It also helps to prevent computationally intensive attacks against complex passwords.
Data handling – Data, both hard and soft, should be kept in designated areas. Soft data should be stored in the appropriate server folder, with user permissions assigned as necessary. Hard data should be available only to those with a need to access it.
Clean desk policy – Physically securing hard data might include storing files in locking file cabinets or the implementation of a “clean desk policy.” Under a clean desk policy, hard data is not permitted to be left at desks while unattended. This type of policy helps to reinforce the importance of routinely protecting data in the mind of the users.
Prevent tailgating – Restricting physical access to an area is only effective if users do not unwittingly bypass physical security. Tailgating is the process by which an unauthorized user follows a legitimately authorized user though a physically secured point. Users should be reminded to allow access only to those known to have access rights, or to require each entrant to authorize individually.
Personally owned devices – Personal devices such as laptops, USB drives, or smart phones have the capacity to hold malicious code. It is important to educate the users about the manner in which these devices may be used, if at all.
Threat Awareness
Users should be aware, at least generally, of the types of threats to their computers. They should be taught basic steps to mitigate these threats as a component of regular user training. This is known as threat awareness.
New viruses – Users should know not to run programs from untrusted sources, such as from unknown e-mail attachments or programs downloaded over peer-to-peer networks.
Phishing attacks – Users should be taught not to log in to sensitive websites through links sent via e-mail.
Zero-day exploits – Previously unknown threats are constantly coming into the wild. Though there is no protection against true zero-day exploits, diligent patching can protect systems from prolonged vulnerability to new attacks as they become known.
Use of Social and P2P Networking
The use of social and peer-to-peer (P2P) networks carries with it the risk of accidental public disclosure of private information. Many P2P network clients share certain information by default. Any files in the shared directories can become available to the world at large. Furthermore, files downloaded from P2P networks can come from an unknown source, often identified only by a file name. Due to the anonymous nature of these downloads, the files should not be trusted without verification of their authenticity (such as a matching MD5 hash of
a known good file.
Social networks can divulge a large quantity of seemingly innocuous information. They may also violate the principle of minimal disclosure. For instance, an attacker may learn via a social networking post that a certain person is out of the office. The attacker may then use that information to convince a subordinate of the vacationing worker to send information that they would not normally divulge, claiming the missing worker was supposed to send it but cannot be reached. To minimize disclosure, employees should be encouraged not to post work details on social networks.