Introduction

Polices, procedures, documentation, and disaster recovery are some of the most important parts of a Security Analyst's job. Well thought out plans and documents provide information that is used to create a successful security system. Without them, organizations would find it difficult to deal with incidents when they occur, or avoid problems that can adversely affect a company. As a Security+ technician, you are expected to understand the fundamental concepts of different policies, procedures, and documentation that make up the foundation on which computer security is built.

This chapter examines the concepts of policy creation. You will see that even though a company may have a wide variety of different policies, without backing from management or a high-level executive, policies may be unenforceable and worthless. In such situations, security procedures may be challenged, declined, or rejected unless there is a good policy in place to enforce them. Having proper backing from decision-makers enables policies to deal with situations when they occur, and deters employees from using technologies that negatively impacts the company. There are many different types of policies and procedures available. A business may have a large collection of policies and procedures that address a variety of issues, because no one document can address every rule, regulation, or situation. The following sections look at some of the common ones that you will encounter or create.

Privilege management allows you to control access through various methods, and is a primary feature of good security. This chapter discusses the fundamentals...