Security Governance and Operational Agreements

### Security Governance

• Organizational policies focus on information security, privacy, acceptable usage, employment, and change management.
• Regulatory compliance is verified through internal and external audits.
• Non-compliance can lead to significant consequences, including sanctions, fines, and reputational damage.
• Governance structure includes management (board and committees) and government agencies.
• Security hierarchy of documents includes policies, standards, procedures, and guidelines.
• Organizational policies include:
  • Information Security policy: defines how an organization manages and protects information.
  • Privacy policy: defines employee privacy expectations.
  • Acceptable Use Policy (AUP): defines acceptable use of company resources.
  • Employment policy: covers employee-employer lifecycle.
  • Change Management policy: defines change management approach, roles, and responsibilities.

Operational Agreements

• Operational agreements include Master Service Agreements (MSA), Service-Level Agreements (SLA), Statement of Work (SoW) / Work Order (WO), Business Partnership Agreement (BPA), Non-Disclosure Agreement (NDA), Memorandum of Agreement (MOA), and Memorandum of Understanding (MOU).

Data Policy

• Data policy components include roles and responsibilities, like data owner, data custodian/steward, data controller, and data processor.
• The General Data Protection Regulation (GDPR) defines data subject, Data Privacy Officer (DPO), and their responsibilities.
• The information lifecycle model encompasses creation, processing, dissemination, usage, storage, and disposal of data.

Asset Management

• Asset management involves maintaining positive control throughout the asset's lifetime.
• Steps include:
  • Acquisition and procurement
  • Assignment and accountability
  • Asset monitoring and tracking
  • Decommissioning and disposal

Risk Management

• Risk management involves identifying, monitoring, and reducing risk to an acceptable level.
• Management establishes risk appetite, which can be expansionary, neutral, or conservative.
• Risk tolerance defines the acceptable variance in business objective performance.
• Risk Identification methods include process analysis, interviews, asset tracking, cognitive computing, and workshops.
• Risk assessment can be one-time, ad hoc, recurring, or continuous.
• Qualitative risk analysis relies on human judgment and opinions, offering insights into the impact beyond financial implications.
• Quantitative risk analysis utilizes numerical values for impact and likelihood, supporting cost-benefit analysis.
• Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE) are used to quantify financial risk.

Secure Cookies

• Secure cookies are configured to prevent them being sent to a domain other than the originator.
• Server configuration settings ensure cookies aren't sent in clear text.
• Success depends on browser support.

Patch Management

• Patch management involves updating the security baseline of firmware, applications, or operating systems to address vulnerabilities and introduce new features.
• Patches can be deployed through centralized or decentralized management systems.
• Effective patch management requires careful monitoring and tracking of deployed patches.

Sandboxing

• Sandboxing creates a controlled environment to isolate components from other operational components.
• Sandboxing restricts access to system resources like memory and storage locations.
• Sandboxing techniques include firewall ACLs, hypervisors, memory managers, and physical isolation.

Bluetooth Technology

• Laptops and controllers communicate over an ad hoc network via the Bluetooth Host Controller Interface (HCI)
• The latest versions of Bluetooth use AES-CCM for frame confidentiality and authenticity
• Bluetooth Secure Authentication uses HMAC-SHA256 with mutual authentication

Wireless Local Area Network (WLAN)

• IEEE 802.11 WLAN protocols deliver data, management, and control frames
• WLAN phases include discovery, authentication, key generation/distribution, data transference, and termination
• Discovery uses management frames like beacon and association frames
• Authentication uses protocols like 802.1X and EAP
• Data-in-transit protection protocols are used during data transference

Wireless Site Survey

• Wi-Fi analyzer, monitor mode, and signal quality assessments are used during this phase
• RFI heat maps are used for assessing radio frequency interference

Wireless Network Protocols and Frequencies

• 802.11a: 5 GHz, 54 Mbps, OFDM modulation
• 802.11b: 2.4 GHz, 11 Mbps, DSSS modulation
• 802.11g: 2.4 GHz, 54 Mbps, OFDM/DSSS modulation
• 802.11n: 2.4 GHz & 5 GHz, 600 Mbps, OFDM/DSSS modulation
• 802.11ac: 5 GHz, 3.5 Gbps, QAM/OFDM/DSSS modulation
• 802.11ax: 2.4 GHz & 5 GHz, 9.6 Gbps, QAM/OFDM/DSSS modulation

Wi-Fi Protected Access (WPA)

• WPA2 is NIST FIPS 140-2 compliant and uses CCMP with AES encryption
• CCMP uses CBC-MAC for packet authenticity and AES-128 for message confidentiality
• WPA2 supports mutual authentication through EAP protocols such as EAP-TLS, PEAP, EAP-TTLS, and EAP-FAST
• WPA3 requires Wi-Fi certification and authenticates AP and client before association
• WPA3 uses IEEE 802.11w Management Frame Protection (MFP)
• CCMP provides data origin authentication and replay protection
• WPA3 uses SAE in personal mode and 128-bit AES key size
• WPA3 enterprise mode uses 192-bit AES key size and supports EAP-TLS, PEAP, and EAP-TTLS

Network Switch Monitoring

• In order to monitor all network traffic passing through a switch, a configuration must be made to the switch to enable mirroring.
• Mirroring allows the switch to send a copy of all network traffic to a monitoring device for analysis.
• This can be used for security, troubleshooting, and performance monitoring.

This quiz covers key concepts in security governance, including organizational policies on information security, privacy, and change management. Additionally, it highlights the importance of regulatory compliance and the hierarchical structure of security documentation. Test your knowledge on how governance impacts organizational practices and operational agreements.