Easier to read with cream paper, a tint, more contrast or larger text? Choose your colours and text, once, for every page.

Preview

DI 1.26; NC 1.25; DS 1.25: Writing security policy with CIA and IAAA

This is the first page of the lesson. Read it and have a go at the activities. The rest is in the full lesson.

50 minutes

A rule with no reason

A firm's security rule says: "Staff must lock their screens." Staff ask why. Nobody can say.

A rule people understand is a rule people follow. The best reasons come from three goals, and four steps at the door.

Today you use them to write rules that make sense.

Key words

WordWhat it means
ConfidentialityOnly the right people can see the data.
IntegrityThe data is correct and has not been changed by mistake or on purpose.
AvailabilityThe data and systems work when people need them.
IdentificationSaying who you are, for example with a username.
AuthenticationProving you are who you say you are, for example with a password and a code.
AuthorisationDeciding what you are allowed to do once you are in.
AccountabilityRecording who did what, so that people answer for their actions.
Security policyA written rule that protects data and systems.
NetworkComputers and devices linked so they can share data.

The cells students fill in are left blank in this preview.

By the end of this lesson

Note

I can turn the three CIA goals into security policy rules, and use the four IAAA steps to stop unauthorised access, misuse, change and denial.

Starter: the core lessons

Have a go

Starter: the core lessons

3 questions
Have a go: your answers are marked here and then forgotten. Sign in if you would like your score kept, and to pick up where you left off.Sign in to keep your score

Your answers are marked here and are not kept. A college account keeps every student’s marks.

Cycle 1: CIA writes the policy

The core security course taught the CIA triad. Here you use it. For each goal, ask: what rule would protect it?

A good policy has at least one rule for each goal. If a goal has no rule, there is a gap.

Worked example: a rule for each goal

GoalQuestion to askA policy rule
ConfidentialityWho must not see this?Staff records are encrypted and only HR can open them
IntegrityWho must not change this?Every change to payroll is logged and checked
AvailabilityWhat if this stops?Back-ups every night and a spare server ready

The cells students fill in are left blank in this preview.

Check: which goal?

Have a go

Check: which goal?

3 questions
Have a go: your answers are marked here and then forgotten. Sign in if you would like your score kept, and to pick up where you left off.Sign in to keep your score

Your answers are marked here and are not kept. A college account keeps every student’s marks.

The lesson goes on

9 more parts of this lesson are in the full curriculum, with the tasks, the final check and the labs. A college account gives your students all of it.

Previous lesson: DI 1.25; NC 1.24; DS 1.24: NCSC 10 Steps and OWASPAll chaptersNext lesson: DI 1.26; NC 1.25; DS 1.25: Directories, passwords and the asset register