MODULE 8: Security Policies & Compliance

Lesson 1: Security Policies (Password, Access Control, BYOD, Email, etc.)

Security policies are written rules that guide how employees, IT teams, and systems must behave to maintain security.

A company with weak or no policies = easy target.

1. Password Policy

Defines:

• Minimum length (12+ characters)
• Complexity requirements
• Password expiration
• Account lockout after failed attempts
• MFA requirements

Purpose:

• Prevent brute-force attacks
• Reduce password reuse
• Strengthen authentication

2. Access Control Policy

Defines how users are given access:

• Role-Based Access Control (RBAC)
• Least Privilege Principle
• Admin accounts separation
• Approval process for access

Purpose:

• Prevent unauthorized access
• Ensure each user only gets required permissions

3. Acceptable Use Policy (AUP)

Defines how employees use:

• Computers
• Internet
• Email
• Social media
• Company devices

Includes:
No downloading pirated software
No installing unknown apps
No connecting unauthorized USB drives

4. BYOD (Bring Your Own Device) Policy

If employees use personal devices for work:

• Must be enrolled in MDM
• Device encryption required
• Screen lock required
• No jailbroken/rooted phones
• Company data must be separable

Purpose:

• Protect company data on personal devices

5. Email & Communication Policy

• No sharing confidential data via personal email
• Training on phishing
• External email marking
• Email encryption for sensitive information

6. Remote Work Policy

Covers:

• VPN usage
• Secure Wi-Fi
• MFA
• Approved devices only
• No working in public spaces with open screens

Lesson 2: Risk Management

Risk management identifies, analyzes, and reduces risks to acceptable levels.

1. Key Terms

Threat

Anything that can cause harm
(e.g., hacker, malware, natural disaster)

Vulnerability

Weakness that could be exploited
(e.g., unpatched system)

Risk

Risk = Threat × Vulnerability × Impact

2. Risk Assessment Steps

1. Identify Assets

• Servers
• Databases
• Applications
• Employee devices
• Customer data

2. Identify Threats

• Cyber attacks
• Insider misuse
• Hardware failure
• Fire
• Power outage

3. Identify Vulnerabilities

• Weak passwords
• Missing patches
• Unprotected S3 buckets
• Open firewall ports

4. Analyze Impact

Impact types:

• Financial (loss of money)
• Operational (downtime)
• Reputational (loss of trust)
• Legal (lawsuits, fines)

5. Prioritize Risks

High → Medium → Low
(using risk scoring)

6. Apply Controls

Controls:

• Technical: firewalls, encryption
• Administrative: policies, training
• Physical: CCTV, access cards

3. Risk Treatment Options

1. Mitigate (reduce)
2. Transfer (insurance, outsourcing)
3. Accept (low risk)
4. Avoid (stop risky activity)

Lesson 3: Business Continuity & Disaster Recovery (BC/DR)

BC/DR ensures the organization continues running even during:

• Cyber attacks
• Power failures
• Server crashes
• Natural disasters
• Fire, flood, theft

1. Business Continuity Plan (BCP)

A BCP focuses on keeping the business running during disruption.

Includes:

• Backup process
• Alternative work sites
• Remote work capability
• Crisis communication plan
• Prioritization of critical services

2. Disaster Recovery Plan (DRP)

A DRP focuses on restoring systems after a disaster.

Covers:

• Server restoration
• Data recovery
• Network recovery
• Backup restoration
• Failover procedures

3. Key Metrics in BC/DR

RTO (Recovery Time Objective)

How long systems can be down before it becomes critical.
Example:
Bank website RTO = minutes
HR system RTO = 4 hours

RPO (Recovery Point Objective)

How much data loss is acceptable.
Example:
Database RPO = 5 minutes
Email RPO = 1 hour

4. Types of Backups

• Full backup
• Incremental backup
• Differential backup
• Cloud backups
• Offsite backups
• Snapshots

5. High Availability (HA)

Techniques to reduce downtime:

• Clustering
• Load balancing
• Failover systems
• Redundant systems (N+1)

Lesson 4: Compliance Standards (ISO 27001, GDPR, PCI-DSS, etc.)

Compliance ensures organizations meet legal and industry security requirements.

1. ISO 27001 — Information Security Management System (ISMS)

Most recognized global security standard.

Organizations must implement:

• Policies
• Risk management
• Access control
• Continuous monitoring
• Audits

Used by:

• Banks
• Government
• Telecom
• Large enterprises

2. GDPR — General Data Protection Regulation

Protects personal data of EU citizens.

Key principles:

• Data minimization
• User consent
• Right to be forgotten
• Data breach reporting
• Strong data protection

Non-compliance = heavy fines.

3. PCI-DSS — Payment Card Industry Data Security Standard

Applies to organizations dealing with:

• Debit cards
• Credit cards
• Online payments

Requirements:

• Encrypt card data
• Restrict access
• Regular monitoring
• Vulnerability scans
• Secure development

Used by:

• Banks
• Payment gateways
• E-commerce

4. HIPAA (Health sector)

Applies to healthcare systems.

Focus:

• Patient data privacy
• Secure storage
• Secure transmission

5. Ethiopian Data Protection Practices

Although Ethiopia does not yet have a GDPR-level law, organizations follow:

• Best practices
• ISO standards
• NBE guidelines (for banks)
• Sector regulations

Lesson 5: Incident Documentation & Reporting

Incident response means documenting and responding to security incidents.

1. What is a Security Incident?

Examples:

• Unauthorized access
• Malware infection
• Data leak
• Suspicious login
• System compromise

2. Incident Response Steps

1. Identification

Detect incident via:

• SIEM alerts
• EDR
• Firewall logs
• User reports

2. Containment

Short-term:

• Disconnect infected device
• Block malicious IP
• Disable compromised user account

Long-term:

• Apply patches
• Strengthen controls

3. Eradication

Remove malware or malicious access.

4. Recovery

Restore:

• Systems
• Data
• Services

Ensure normal operations.

5. Lessons Learned

Document:

• What happened
• Why it happened
• How to prevent next time

Use findings to improve:

• Policies
• Monitoring
• Network security
• Employee training

3. Incident Reporting

Reports include:

• Time & date
• Who detected
• What systems affected
• Impact assessment
• Steps taken
• Future recommendations

Useful for audits and compliance.

Module 8 Summary

Students now understand:

• Why security policies are critical
• How risk is identified and managed
• How organizations survive disasters & cyber attacks
• Major compliance standards like ISO 27001, GDPR, PCI-DSS
• How to document and report security incidents

This module answers the question:
“How do organizations build long-term, policy-driven, compliant security?”