Elements of a Good Policy, Mike Simon

So, let's talk a little bit about elements
of good policy.

Number one on my list driven directly by
business requirements.

It will enable productivity by allowing
secure access to information resources.

One of,
One of the things that we, as computer

security professionals typically do wrong.
A, we used the wrong language in

describing what we're trying to do.
B, maybe we're using the right language in

the wrong way.
So, if I walk into a, a group of my peers

or executives and I start talking about
this new initiative where we're going to

protect these laptops that are
unfortunately, flying off the shelves or

out of our cars.
And I start by saying well, what we need

to do is prevent X, keep Y from happening
and make sure that we absolutely stop Z.

What the executive is hearing is, he is
preventing stopping in all kinds of ways

making stuff not happen.
That's not their world.

Their world is about making things happen.
Their world is about making the needs of

the business come first.
And those business requirements happen in

the smooth as possible way.
So, when you chart, when you start out in

negative terms.
When you start out defining things that

won't happen.
And things that must not be.

They're not hearing any of what you say.
They're just hearing that you're a big

preventer.
Alright if when that's the case you're,

you're not going to be able to make your
case.

So, you know a good policy is, is an
enabler.

Good policy says hey look a this we found
a secure way to actually allow all you

people out there to run around with your
laptops like you always have.

If we weren't able, what you are not
seeing in this policy is if we weren't

able to find that secure way,
We'd be asking you for your laptops back

because we can't have this keep happening,
You know, let the firings begin.

So.
I think good policy is clear, and, and,

and usually short.
My customers.

I, I develop a lot of policy for my
customers.

They're always surprised by how brief I
typically make them.

I'm, I'm always striving to make short
statements that completely make sense to

everybody that reads them, in terms of
policy.

When we start talking about the technical
stuff, when we get into procedures,

guidelines, and all that kind of stuff,
then we can get into all the geeky

technical stuff that must happen to make
this policy work.

But when it's about the policy,
I've personally have never written a

policy that was more than two pages long,
about a specific thing.

If you can't describe the thing you want
to happen in two pages, you've, taken on

the wrong thing, essentially.
You, you, you're going about it the wrong

way.
You need to break it down a little bit

further such that you can make simple
policy statements that people understand.

A corollary to that is it should be
measurable.

When I'm, when I'm talking about
measurability here, I'm talking about the

ability to measure compliance.
Then we'll, we'll get into a lot of, more

about that when I start talking about
maturity models and, and how maturity

models relate to policy but the simplest
way to think of this is that if you have a

policy, and you think that policy is in
place, and the people understand it, and

that it's actually doing what it's
supposed to be doing.

You don't actually know that unless you
can actually measure compliance.

Unless you can look at It's amazingly
annoying.

Unless you can actually look at this
policy and how people are behaving in

relationship to the policy and say, well
this is how well the policy's doing.

Or hey, the policy's not, you know?
People either don't understand it, they

don't know it.
Or they do understand it and they know it

and they're not complying.
What's the number one reason that people

don't comply to policy?
Complexities is one.

It's not the top of my list but it's, it's
near the top.

We weren't told it in the first place.
Well now I've sure told it.

In the back.
[inaudible].

Inconvenience.
That is the number one reason that people

do not adhere to policy.
And, that inconvenience typically I,

interestingly enough, most of us wanna try
to do our job.

The inconvenience is typically related to,
this policy makes it hard, impossible,

difficult to do the thing that you hired
me to do.

So I am going to ignore it.
So, you have to avoid all of that kind of

mess.
Good policy has to be enforceable.

What we mean by enforcement is going to
vary actually from company to company,

organization to organization.
But you have to actually have some way of

saying you must accomplish this thing that
we have asked you to do, or, there are

consequences alright?
The variability for that is, is industry

variability. It's regulatory compliance
variability.

There's lots and lots of reasons that
that's not the same for everybody.

Number five on my list,
And I invented a word for this.

It's regulatorily correct." The
spellchecker didnt like that.

Obviously what I mean though is that
policy itself must reflect any regulations

that actually drive what your business
must do.

Raise your hand if you're in an industry
that has no federal regulations regarding

your security policy.
Wow.

I asked that exact same question about
three years ago.

And three-quarters of the class raised
their hands.

Until one by one I explained what,
regulation, what federal agency cared

about them.
It's almost never been true, but it's

certainly not true now.
Hyppa. Gramm-Leach-Bliley.

What's another, who haven't I got?
Socks.

Socks, of course, that's all of you that
are public.

Any other fun ones that I'm missing?
Icar, ITAR, ITAR? .

All of you Boeing people are e, expoing
people.

[inaudible] [laugh].
You took your laptop and left.

[inaudible].
[laugh] So, okay, and again, the category

of, of, of the list we are going through
right now is elements of good policy,

those were mine.
What are yours?

What else should good policy have?
I listed everything.

Yes.
We did a review.

Absolutely.
Good policy, and actually good maturity in

your policy, requires regular review.
Yes.

I was going to say accessibility.
In other words, it's got to be, people

have to be able to find it and read it.
Accessibility is critical.

The, the idea that you're going to
generate a bunch of policy and you know,

print it and then put it on a shelf for
somebody to come and you know, at their

leisure come and read is never going to
happen.

Beyond accessibility I would actually try
to take up the next step and I'm not sure

what they call this but essentially,
mandatory accessibility.

You have to make sure that people are
exposed to your policy.

You can't just make it available and say,
look, you know what, we wrote 800 pages of

policy and it's on this internal link to
this web server.

Please, everybody go read it.
How many would?

Everybody in this class would, of course,
because you're directly involved and care

a lot about these sorts of things but none
of your peers would.

You absolutely must make sure that they
read it.

Given that scenario, given the scenario of
an internet server and you've made it

available.
Any ideas on how, how you would enforce

that, or how you would assure?
Yes.

The agreements are on hiring and
orientation.

Orientation, new employee orientation is a
good place to have people at least sign a

piece of paper saying that they read the
last 400 pages and they agreed to

everything in it.
Yes.

In my company they put it on video and
they track everyone who's viewed it.

Once you've watched them all you get a
little certificate of completion.

It's not real but it's like tracked and if
you don't do it they harass you and your

manager until you do it.
And, so, they have 90, over 99 compliance

in people viewing the latest training on
it.

So.
A technology company, they actually are

tracking probably electronically whether
or not you've clicked on the view this

video link.
They didn't track whether or not you

walked away from your desk while you're.
It's like.

How many of, how many viewings actually
started at eleven:5959.

Nobody tracked that part?
Yes, in the back, and then you.

[inaudible].
We had a, for a sexual harassment

training, we had to take some tests.
We had to watch some videos on some

website, and then take a test afterwards
regarding each of these.

And it went into quite a bit of time.
It was spread out over, like, a couple

weeks or something.
Tests are fantastic.

A fantastic way to assure that somebody's
actually, not only read something, but

understood it.
Let me get back to that in a moment.

Go ahead.
[inaudible].

Our interactive training system.
And it does have tests embedded in the

viewing.
So, unless you take somebody else's, which

nobody's going to do,
Right?

And I know we have a lawyer in the room,
who is it?

[inaudible].
Ted's not here?

No lawyer in the room.
There's a very interesting thing going on

right now in the sort of, click-through
agreements, which is that.

The courts are, and I wish it was here
actually to correct me because I am sure I

am wrong on this.
But the courts are getting a little wishy

washy on whether or not any of that is of
any value.

So, yes.
[inaudible] because, just because

somebody's indicated that they have put
through a page or they've accepted that

page does not ensure that, that content
hasn't changed.

So what have they accepted?
And that's not necessarily a static thing.

Agreed.
Although even the static stuff.

People are wondering whether or not it's
reasonable to assume that you did actually

read all twenty pages of legal mumbo jumbo
before you clicked on the yes.

I'm going to okay this because that means
I can now use XP.

Yes.
I've researched this.

It's less than zero, probably.
001.. People might, some people will

possibly start to read it, and then they
will scroll and see how long it is and

give up.
But no one, I've never seen anyone

actually put in the effort to read it.
And that's with someone watching them and

them wanting to please me.
[inaudible].

Huh?
Who [inaudible].

Yeah, lawyers.
Actually they read chunks of it.

Maybe it's five or six of them and they
all put it together, so none of them read

the whole thing.
That, and, there's, there's a few perverse

people out there in the world, who
actually, I, I think they're kind of, good

examples of creative writing.
And I read them because I, I'm amused by

some of the stuff they put in there about
the fact that you know they're not

responsible with it, you know, if.
Good example, Windows Vista, if Windows

Vista explodes, and the parts fly
throughout the room.

Completely obliterate all life.
Windows is and Microsoft is not

responsible.
Absolutely guaranteed.

It's, it's definitely on like page 30.
The whole explosion part.

Isn't there something in here about the
wind blows and the tree falls.

That Microsoft isn't.
Certainly not responsible.

So, not very many people are like me.
Not very many people actually think that's

a muse in reading.
They actually just page down as far as

they can and click on the, it's okay
button.

Most amusing thing I think I ever saw in
one of those was actually that somebody

programmatically looked at how long it
took between displaying the first page and

you clicking on the Okay.
And if it wasn't long enough.

They just said, "Look, you didn't read
that.

Go back and try again." [laugh] I, I
thought that was hilarious.

But.
And that's why testing, actually, starts

as starts to around a little bit of this.
I can't imagine what would happen if some

of the longer click through agreements
started asking okay, so, under limited

liability.
Were we a liable for any pet deaths in

your family?
[laugh] So these sorts of things are

actually starting to, to change the way we
look at stuff.

I really, really like by the way new
employee orientation and new employee

agreements with tests.
I'm starting to see places that actually

implement.
You must read all of this stuff, all of

these policies, procedures and how do we
do business and so on and so forth.

And, sometime within the next couple of
days your going to have to take a test on

it, and pass or you're not an employee.
So,

Anything, any other by the way, all great
elements of good policy.

Yes?
[inaudible].

Absolutely.
You have to have something to back it up.

If, I merely suggest to all of you that
you don't take employee data, and

willy-nilly, start flapping around the
internet.

And I'm not prepared to do anything about
it if you do.

The policy has no effect.
It has, it has really no, no teeth.

Yes.
I think policy should be enforced at all

levels of the organization.
So senior management is responsible for

living up to that policy as well as junior
staff.

We've had situations where political
content, for instance, was sent through

the email to employees regarding certain
initiatives from senior management.

And it was pointed out to them, you
realize you just made a policy

unenforceable.
Yeah.

[inaudible].
And then, that's actually.

And, and who do, I won't even ask who you
work for.

A healthcare organization.
A healthcare organization.

[inaudible] That's what the issue is.
Interesting.

That, I see that a lot more in smaller
organizations, you know, organizations of,

of few 1000 people and less where the
management of the organization is not used

to having to kind of put up with this
uniformity of policy enforcement.

Larger organizations usually kind of get
it.

Not always.
I mean there's.

[inaudible].
Yeah, yeah.

It's so, it is absolutely.
It is very, very important that people

realize that policy is enforced from the
top to the bottom.

In fact, it's you know, emanates from
business requirements set by the people at

the very top.
So, if those business requirements

dictated this policy.
And they violate policy.

Either the business requirements weren't
accurate in the, in the first place.

Or they're actually count, acting
countered to the best interest of the

company, or the organization.