CMM7XX

Security Policy

Session 11: Formation and Enforcement

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Understand Information Security Management Systems (ISMS) like ISO 27001.
  • Deconstruct the governance hierarchy: Policies, Standards, Guidelines, and Procedures.
  • Analyze technical enforcement mechanisms (DLP, CASB).
  • Evaluate the psychology of Insider Threats.
  • Draft rigorous, auditable security standards for enterprise environments.

The Policy Hierarchy

Documentation must be structured to prevent constant executive bottlenecks.

  • Policies: High-level, mandatory directives driven by the Board (e.g., "All sensitive data must be protected"). Rarely changes.
  • Standards: Mandatory technical constraints to support the policy (e.g., "AES-256 must be used for all database encryption"). Changes when technology evolves.
  • Guidelines: Non-mandatory recommendations (e.g., "Suggested naming conventions for firewall rules").
  • Procedures: Step-by-step mandatory instructions (e.g., "How to configure AES-256 on an AWS RDS instance"). Changes frequently.
Practical Resource: ISO/IEC 27001 Information Security Management

The Gap Problem

Audits fail because organizations have beautiful high-level policies, but no technical standards mapping those policies to actual engineer behavior.

  • If a policy says "Use strong passwords," it is unauditable.
  • A standard must say "Passwords must be >14 chars, checked against HIBP, rotated every 90 days."
Practical Resource: ISO/IEC 27001 Information Security Management

Introduction to Task 1

Bring Your Own Device (BYOD) is a massive governance nightmare. How do you secure corporate data on a device the company does not own?

We will bridge the gap between a high-level Board policy and the technical implementation.
Practical Resource: ISO/IEC 27001 Information Security Management

Task 1: ISMS Standard Drafting

Timing: 45 minutes

Board Policy: "Employees may use personal devices for work, provided corporate data remains isolated and secure."

  1. Draft a formal Security Standard governing BYOD usage.
  2. Your standard must mandate specific Mobile Device Management (MDM) technical controls (e.g., containerization, remote wipe capabilities).
  3. Address the privacy conflict: How do you mandate the ability to remote wipe the corporate partition without giving IT access to the employee's personal photos?
Practical Resource: ISO/IEC 27001 Information Security Management

15 Minute Break

Please return promptly for Part 2.

Part 2: Enforcement & Insider Threats

Duration: 1.5 Hours

Practical Resource: MITRE ATT&CK Framework

Enforcement Mechanisms

Policies are useless without technical enforcement.

  • Data Loss Prevention (DLP): Software that inspects data in motion (network), data at rest (storage), and data in use (endpoints) to prevent sensitive data exfiltration (e.g., blocking an email containing credit card numbers).
  • Cloud Access Security Broker (CASB): A control point sitting between users and cloud applications (SaaS/IaaS) to enforce security policies. Essential for preventing "Shadow IT" (e.g., employees using unauthorized Dropbox accounts).

The Insider Threat

The hardest threat to defend against because the user already possesses valid credentials and authorized access.

  • Malicious Insider: Disgruntled employees seeking revenge or financial gain (e.g., stealing source code before resigning).
  • Negligent Insider: Employees who bypass security policies for convenience (e.g., uploading PII to an unencrypted public S3 bucket).
  • Compromised Insider: A legitimate user whose credentials have been stolen via phishing.
Practical Resource: MITRE ATT&CK Framework

User Entity Behavioral Analytics (UEBA)

How do we detect malicious insiders?

  • Static rules fail because the insider's actions might technically be allowed.
  • UEBA uses Machine Learning to establish a baseline of "normal" behavior for every specific user.
  • If a developer who normally downloads 50MB of code a day suddenly downloads 5GB at 3:00 AM on a Sunday, UEBA flags the anomaly, even if the user has authorization to access the repository.
Practical Resource: RFC 2104: HMAC: Keyed-Hashing for Message Authentication

Introduction to Task 2

Configuring DLP requires a deep understanding of data formats (Regex) and contextual awareness to avoid blocking legitimate business processes.

We will design a DLP architecture to protect Payment Card Industry (PCI-DSS) data.
Practical Resource: Saltzer & Schroeder: Protection of Information in Computer Systems

Task 2: DLP Architecture Design

Timing: 50 minutes

Your company processes credit cards. You must prevent PANs (Primary Account Numbers) from leaving the corporate boundary via Shadow IT.

  1. Write the regex logic required to identify a 16-digit credit card number.
  2. Discuss why regex alone causes too many false positives (e.g., random database IDs). How do you use the Luhn Algorithm algorithmically to reduce false positives?
  3. Design a CASB policy that allows users to upload PAN data to the corporate OneDrive, but strictly blocks uploads to personal Dropbox or Google Drive accounts.
Practical Resource: Saltzer & Schroeder: Protection of Information in Computer Systems

Summary & Next Steps

  • Technology serves Governance. Without clear, auditable policies, technical tools lack direction and justification.
  • Insider threats bypass firewalls by definition; they must be managed through strict RBAC, DLP, and Behavioral Analytics.
Next Week: Cybercrime, Laws and Ethics (Legal Frameworks)
Practical Resource: MITRE ATT&CK Framework