Page 766 - StudyBook.pdf

750 Chapter 12 • Operational and Organizational Security: Policies and Disaster Recovery

A code of ethics is a statement of mission and values, which outlines the
organization’s perspective on principles and beliefs that employees are
expected to follow.

An incident response policy provides a clear understanding of what
decisive actions will be taken during security breaches or other incidents,
and who will be responsible for investigating and dealing with problems.

Privilege Management

Privilege management involves the administration and control of the
resources and data available to users and groups in an organization.

Security settings can be applied to users, groups, or roles. Users accounts
can have specific settings applied to them individually.To make
management easier, security settings can also be applied to groups, so that
each account in the group has the same settings applied. If a user performs
a specific role in an organization, the account can also be associated with
the role.
Single sign-ons allow users to logon to a network once, and use resources
on multiple servers and systems throughout the network.
Centralized server models have all servers located in a single location, such
as a main server room. Decentralized server models have servers located at
different locations throughout the network.
Auditing is the process of monitoring different events to determine if
there are lapses in security. Enabling auditing on a system allows
administrators to have the system record certain events to a log file or
notify someone (such as by sending e-mail).Analyzing these records allows
administrators to identify attempted and successful breaches of security,
and discover where lapses in security exist.
MAC has every account and object associated with groups and roles,
which control the user account’s level of security and access.
DAC allows access to data to be placed at the discretion of the owner of
the data.
RBAC involves users being associated with different roles to obtain access
to resources and data.

www.syngress.com