Cyberstudy
PDF p.377 In progress Not in the PDF's table of contents

Internal Standards

Open PDF at p.377 24 flashcards

Summary

PDF p.377

Internal standards ensure the safety and integrity of operations, protecting data, intellectual property, and hardware. They provide consistent descriptions for managing organizational practices.

In plain words

Supplementary — not from your PDF

Internal standards set consistent requirements for the organization's own practices: password standards (hashing, salting, secure transmission, resets, managers), access control standards (models, authentication protocols, session management, audit trails), physical security standards, and encryption standards (algorithms, key length, key management).

Detailed explanation

PDF p.377
  • Password Standards
    • Hashing Algorithms: Requirements for hash functions.
    • Password Salting: Methods to protect password hashes.
    • Secure Transmission: Methods for secure password transmission.
    • Password Reset: Identity verification methods.
    • Password Managers: Requirements for password managers.
  • Access Control Standards
    • Models: Role-based, discretionary, and mandatory access control.
    • Identity Verification: Methods to verify identities.
    • Privilege Management: Managing user privileges.
    • Authentication Protocols: Acceptable protocols like Kerberos, OAuth, or SAML.
    • Session Management: Practices for session timeouts and secure cookies.
    • Audit Trails: Mandatory audit capabilities.
  • Physical Security Standards
    • Building Security: Card access, CCTV, security personnel.
    • Workstation Security: Securing portable devices.
    • Datacenter Security: Card access, biometric scans, visitor logs.
    • Equipment Disposal: Secure disposal of equipment.
    • Visitor Management: Sign-in procedures, badges, escorted access.
  • Encryption Standards
    • Algorithms: Allowable encryption algorithms like AES and ECC.
    • Key Length: Minimum key lengths.
    • Key Management: Generation, distribution, storage, and changing of keys.

Important terms

taken from the text above
Hashing Algorithms
Requirements for hash functions.
Password Salting
Methods to protect password hashes.
Secure Transmission
Methods for secure password transmission.
Password Reset
Identity verification methods.
Password Managers
Requirements for password managers.
Models
Role-based, discretionary, and mandatory access control.
Identity Verification
Methods to verify identities.
Privilege Management
Managing user privileges.
Authentication Protocols
Acceptable protocols like Kerberos, OAuth, or SAML.
Session Management
Practices for session timeouts and secure cookies.
Audit Trails
Mandatory audit capabilities.
Building Security
Card access, CCTV, security personnel.
Workstation Security
Securing portable devices.
Datacenter Security
Card access, biometric scans, visitor logs.
Equipment Disposal
Secure disposal of equipment.
Visitor Management
Sign-in procedures, badges, escorted access.
Algorithms
Allowable encryption algorithms like AES and ECC.
Key Length
Minimum key lengths.
Key Management
Generation, distribution, storage, and changing of keys.

Examples & real-world scenarios

Supplementary — not from your PDF
  • A password standard requiring salted hashing.
  • An encryption standard mandating AES with a minimum key length.
  • An access control standard specifying Kerberos, OAuth or SAML.

Scenario

Different teams use different encryption strengths. An internal encryption standard sets allowed algorithms and minimum key lengths so everyone is consistent.

Common mistakes

Supplementary — not from your PDF
  • Leaving encryption or password choices to each team.
  • Setting standards but never auditing against them.

Practical skills

Supplementary — not from your PDF
  • Draft an internal standard for one area.

What I should remember

Key Points PDF p.377
  • Password Standards: Hashing, salting, transmission, reset, managers.
  • Access Control: Models, verification, management, protocols, sessions, audits.
  • Physical Security: Building, workstation, datacenter, disposal, visitor management.
  • Encryption: Algorithms, key lengths, key management.