In this lesson,
we're going to discuss some operational controls,
including job rotation, mandatory vacations, user training,
and time-of-day restrictions.
First, we have job rotation.
With job rotation, different users are trained
to perform the task of a position,
and this helps prevent the identity fraud that could occur
if only one employee had that job.
Basically, if multiple people
know how to perform a certain job, then it's more likely
that somebody can detect unusual activity
than if there's only a single person
who does that job by themselves.
Besides the security benefits
of protecting against fraud and abuse,
job rotation also provides a great opportunity
to cross-train your employees
and to develop trained personnel
to back up the primary employee in case of emergency.
Job rotation is definitely a control to consider
when you're writing your organization's security policy.
Second, we have mandatory vacation policy.
Mandatory vacation requires that every employee
takes a vacation at some point during the year.
This makes them have to take a vacation
and forces someone else to come in
and do their job functions for them.
When someone else is performing those job functions
while the other employee is out on vacation,
they may uncover some type of unusual activity,
such as fraud or abuse, that has to be looked into further.
Third, we have user training.
User training is essential for reinforcing the importance
of securing the organization's valuable resources.
This includes educating users on the current threats
facing the organization
and what to do in case of an event or incident.
All employees should attend security awareness training
at least once a year.
Studies have shown that this is by far
the best return on investment that a company can make
into their own security policy
as users are the biggest vulnerabilities
in most organizational networks.
Security training teaches the organization's personnel
the skills they need to perform their job
in a more secure manner,
focusing on IT staff and administrators.
Finally, we have time-of-day restrictions.
Time-of-day restrictions are a type of security control
that relies on normal operating hours for businesses
and then limit any access during non-work hours.
For example, if a company operates
between 9:00 AM and 5:00 PM,
there isn't a reason for somebody to log in at 1:00 AM.
Setting up time restrictions
can be done as a technical control,
but an overarching policy to finding
what those normal times are is an operational control.
These restrictions reduce the impact of stolen credentials
because attackers would have to operate
during your work hours,
giving your defenders a chance to catch them
during those times.
So, remember, operational controls like job rotation,
mandatory vacations, user training,
and time-of-day restrictions are essential tools
in securing your organization.
They help prevent and detect fraud,
ensure continuity through cross-training,
reinforce the importance of security among users,
and limit access to sensitive information
to appropriate times.
Implementing these controls
will bolster your security posture
and help protect your organization
from internal and external threats.