CertiGuide to Security+  9  Chapter 5:  Operational/Organizational Security (Domain 5.0; 15%)

5.9.7  Destruction 1 2 3 4 5 5.11  Success Questions

Education

You were also made aware of the important role played by education. In order for users to follow policy, you need to communicate to them how their interests are served by those policies, and interact with them to determine how some policies may make their lives more difficult, and work with them to improve those policies. User awareness is critical, since employees need to be aware of policies and significant vulnerabilities (such as viruses and social engineering attempts) in order to best exercise “due care” in the performance of their job duties.

Finally, you learned the importance of complete, up-to-date documentation, including:

• Standards and Guidelines, specifying the standards and guidelines your organization/department adhere to.
  
  
• Systems Architecture, including network maps, lists of software installed on systems, configuration printouts, etc.
  
  
• Change Documentation, which tracks changes to system and network configuration over time; not only is this a valuable history, but it may also be useful if the most recent change “broke something” and the administrator who made the change isn’t around to explain what he did.
  
  
• Logs and Inventories, documenting equipment maintenance, backups, etc.; inventories may include asset lists, inventories of spare parts, available backup media, etc.
  
  
• Classification, specifying the sensitivity of particular types of data and/or systems.
  
  
• Notification, who must be notified in the event of certain events like intrusion detection, theft, disaster, etc.
  
  
• Retention/Storage, policies and procedures for securely storing physical and electronic records, specifying where they are stored and how long they are kept; this may be partly determined by industry regulations followed by your organization.
  
  
• Destruction, how and when documentation and other items such as media are destroyed; for high-security installations, the procedures involved may be complex.

5.9.7  Destruction 1 2 3 4 5 5.11  Success Questions