↓ Skip to main content
Samarthya
Samarthya
Security

Security Standards, Baselines and Guidelines: Formalized security policy structure.

·1 min
Technical Baselines Cissp Guidelines Seuritypolicystructure Standards

#

Standards
#

Standards are tactical documents that define steps or methods to accomplish the goals and overall direction defined by the security policies.

  1. They define compulsory requirements for homogeneous use of software hardware and security controls.
  2. Provides for a uniform implementation throughout an organization.

Baseline
#

Defines a minimum level of security that every system within the organization should meet.

  1. Establishes a common foundational secure state on which additional measures can be built.
  2. Additional layers are more stringent and as per the organization needs.
  3. Often are system specific and pertinent to an industry or government standard.

Guidelines
#

Recommends how standards and baselines should be implemented to serve as an operational guide for both security professionals and end users.

  1. They are flexible
  2. Stares security mechanisms rather than specific products and settings.
  3. Not compulsory
  4. Outline methodologies
Pyramid of security policy documents: standards at the top, then baselines, guidelines and procedures

The purpose of procedure is to ensure integrity of business process. It helps in standardization of security across systems in an organization.

Author
Samarthya
Engineer, learner, tinkerer. This is my trophy shelf of everyday work and leisure.

Related

CISSP: Next target

CISSP: Next target

·1 min
Technical Cissp Notes
I just finished my upgrade to Safe Certification and now will be going for CISSP certification. Wish my luck guys! Some quotes # Effective security plans anticipates change, focuses on specific and achievable objectives, potential problems, and serves as the basis of decision making. Operational plans are the shortest and most frequently updated Tactical plans are mid term plans and supports strategical plans. Strategic plans are the long term plans (usually 5 years) and usually includes risk assessment. Data classification is the primary means by which data is protected based on its need for secrecy, sensitivity and confidentiality. Data classification is the process of organizing objects, subjects, items into groups of similarities (value, cost, vulnerability, risk, power, privilege) Stratify the process of organizing and securing data based on assigned labels of importance and sensitivity. Data classification also addresses how data is removed and destroyed. Security policy is used to assign responsibilities, define acceptable risks, define roles, specify audit requirements and indicate compliance. Security policy are not optional rather mandatory. Three types of security policies are regulatory, advisory and informative.
Identity

Identity

·1 min
Technical Cissp Identity
What is an identity? # Identity is the link that correlates the subject and the authentication process. Without a valid identity the system has no way of establishing who the subject is? Identity enables the subject to be identified and validated, and only once it has been established and authorized it is accountable for any actions taken in the system.