Chapter 7 Secure-Use Practices Defensive Best Practices.ppt

Chapter 7 Secure-Use Practices: Defensive Best Practices Presented by: Derrick Lowe Ken Dean Quintin King Caroline Hawes Introduction This chapter focuses on what companies must do to protect themselves from internal risks. Before hackers and the internet there were: Disgruntled workers Careless administrators Hostile managers Introduction cont’ Current technology amplifies security threats, can be blamed on organizational practices Effective countermeasures Secure-use practices User training Secure Use Practices: Policies Major Risk Factors Most likely sources of cyber threats continue to come from within. Unknown and unseen hackers and thieves are not the most common threat. It is difficult to accept the reality that a majority of cyber security incidents are traced to company insiders. Examples An unwitting employee may spread infected email or be tricked into revealing information through a popular hacker technique – social engineering. Spoofing-disguising true identity of the sender Administrators may be unable or unwilling to apply software patches to fix known vulnerabilities. Limits On The Extent To Which Risk Factors Can Be Controlled A complete set of updated, well-documented policies and training in security procedures can be time-consuming. They are not without risks Selectively enforced policies can be worse than having none at all If employees send threatening messages to each other and company fail to notify law enforcement, they can be held liable for negligence Enforcement Of Secure-Use Practices Must Be Consistent With AUP A clearly written Acceptable Use Policy and documentation of confirmation from employees that they read, understood, and agreed to its terms in addition to the Secure-Use practice can help a company avoid costly lawsuits. Key Secure – Use Procedures and Practices Security Focus in Organizational Planning Process Information security for organizations may not always follow a standard pattern: Develop a business plan Defines go