Page 688 - StudyBook.pdf

672 Chapter 12 • Operational and Organizational Security: Policies and Disaster Recovery

Introduction

Polices, procedures, documentation, and disaster recovery are some of the most
important parts of a Security Analyst’s job.Well thought out plans and documents
provide information that is used to create a successful security system.Without
them, organizations would find it difficult to deal with incidents when they occur,
or avoid problems that can adversely affect a company.As a Security+ technician,
you are expected to understand the fundamental concepts of different policies, pro-
cedures, and documentation that make up the foundation on which computer
security is built.
This chapter examines the concepts of policy creation.You will see that even
though a company may have a wide variety of different policies, without backing
from management or a high-level executive, policies may be unenforceable and
worthless. In such situations, security procedures may be challenged, declined, or
rejected unless there is a good policy in place to enforce them. Having proper
backing from decision makers enables policies to deal with situations when they
occur, and deters employees from using technologies that negatively impact the
company.There are many different types of policies and procedures available.A
business may have a large collection of policies and procedures that address a
variety of issues, because no one document can address every rule, regulation, or
situation.The following sections look at some of the common ones that you will
encounter or create.
Privilege management allows you to control access through various methods, and is
a primary feature of good security.This chapter discusses the fundamentals of single
sign-on technology, auditing, and how to find and address problems as they occur.
Education and documentation are two topics that are extremely important, yet
often overlooked as part of security. If users were educated more, the amount of
hacking in a company (or home) system would drop significantly. For instance,
many users do not understand the importance of securing passwords, and use pass-
words that are easy to guess or they leave them in plain view. Education informs
the user as to what is expected of them, and how to perform actions securely.
Documentation provides a resource on how tasks are to be carried out, chronicles
changes to systems, and provides a written record that contributes to an organiza-
tion’s security.
Business continuity and disaster recovery are covered in great detail on the
Security+ exam; however, they are also a fundamental part of any secure infrastruc-
ture.This chapter will show you how to implement a sound plan to keep your
business running and disaster free.

www.syngress.com