edd_t Posted April 2, 2008 Share Posted April 2, 2008 My brain hurts... Ive been asked to write up some info for out policy and procudes manual at work. Has anyone had to do similar, am guessing maybe a few compliance or IT directors out there may have had to... I've been give a template (below) of information, but to tell the truth after about the 4th line it all sounds a load of crap... Procedure [This section should set out how you create user profiles, summarizing (by operating systems and application) into standard profiles the individual user/user group access rights and the business requirements met by the controls, taking into account the Access Control Policy and ensuring that application level access control is consistent with the network level access control. This procedure should reference DOC 11.3, which deals with administration of user rights, and (a suitably tailored) Operations Work Instruction DOC 10.3, which sets out the IT user name and access rights administration. This is also the place to deal with group IDs (ID = user name) – for preference, your rule should be that you do not allocate group IDs – if you have to, this is where you explain why. It might be because you have some functions where you do not need to track users and can safely provide read-only access. It might be because there is no other option, in which case you need to be clear about what other controls you might put in place. Access rights are: read, write, delete and execute and these rights need to be allocated in respect of each system and application. You need to identify how you enforce access rights to applications in line with (ISO 17799 clause 11.6.1) information classification levels and that application outputs are sent only to authorized users.] Quote Link to comment Share on other sites More sharing options...
Wez Posted April 2, 2008 Share Posted April 2, 2008 Sounds like management bull to me. I dont like procedures, they get in the way of work and are generally there to help people who dont know what they are doing Quote Link to comment Share on other sites More sharing options...
hiten55 Posted April 2, 2008 Share Posted April 2, 2008 i was meant to in my previous job, but thankfully i managed to get out of doing it by prioritising other work. man i dont envy you at all mate, its a pita!! good luck bud Quote Link to comment Share on other sites More sharing options...
michael Posted April 2, 2008 Share Posted April 2, 2008 Yep, I have documents like that for pretty much everything anyone might want to do, it's tragic really but it would be chaos without them. Quote Link to comment Share on other sites More sharing options...
edd_t Posted April 2, 2008 Author Share Posted April 2, 2008 thats not the only one i have to do. its just the first of many i guess it will be good, at the moment most things i know/do are in my head so if i get hit by a bus no one will have a clue on how i set stuff up. its just a pain having to write it down especially having to conform to guidlines like the one above! Quote Link to comment Share on other sites More sharing options...
Wez Posted April 2, 2008 Share Posted April 2, 2008 thats not the only one i have to do. its just the first of many We had a technical writer contracted to us from upper management who was basically hired to document our jobs, the idea being anyone could follow a script and complete our work. He lasted less than a week Quote Link to comment Share on other sites More sharing options...
JustGav Posted April 2, 2008 Share Posted April 2, 2008 Honestly?? Copy and paste a good one and alter.... (sad but true ) Quote Link to comment Share on other sites More sharing options...
michael Posted April 2, 2008 Share Posted April 2, 2008 We had a technical writer contracted to us from upper management who was basically hired to document our jobs, the idea being anyone could follow a script and complete our work. He lasted less than a week That's one of my many tasks - the hard bit was writing the document to document how the document telling people how to document things should be documented. Quote Link to comment Share on other sites More sharing options...
Gaz6002 Posted April 2, 2008 Share Posted April 2, 2008 I've written several procedures and official work instructions. It's all about being able to put things into a concise and professional generalisation. Now that sounds like management bull. One thing you will find is that you learn your own job better than you thought possible. It can be tedius but at the end of it not only will know the documents inside out but you'll have something to show for your hard work. Quote Link to comment Share on other sites More sharing options...
JustGav Posted April 2, 2008 Share Posted April 2, 2008 That's one of my many tasks - the hard bit was writing the document to document how the document telling people how to document things should be documented. And let me guess it went through peer review for about 10 months Quote Link to comment Share on other sites More sharing options...
Wez Posted April 2, 2008 Share Posted April 2, 2008 The thing is we all have our own documentation but its not public Quote Link to comment Share on other sites More sharing options...
edd_t Posted April 2, 2008 Author Share Posted April 2, 2008 Honestly?? Copy and paste a good one and alter.... (sad but true ) wish i had one to copy! haha Quote Link to comment Share on other sites More sharing options...
Gaz6002 Posted April 2, 2008 Share Posted April 2, 2008 The thing is we all have our own documentation but its not public Same with where I used to work. Secure government network management procedures aren't something to be shared with the public. Shame really as I did some good work for them. Oh well, onwards and upwards. Quote Link to comment Share on other sites More sharing options...
grahamc Posted April 2, 2008 Share Posted April 2, 2008 I got asked to do this about 6 months ago... wrote half a policy, got to the exceptions, could not agree with the exceptions. Now they do not ask anymore All the "true" techies do NOT do documentation, especially policies! Quote Link to comment Share on other sites More sharing options...
edd_t Posted April 2, 2008 Author Share Posted April 2, 2008 do you think i can get away with just putting "Ask Edd" in every procedure? Quote Link to comment Share on other sites More sharing options...
Gaz6002 Posted April 2, 2008 Share Posted April 2, 2008 I got asked to do this about 6 months ago... wrote half a policy, got to the exceptions, could not agree with the exceptions. Now they do not ask anymore All the "true" techies do NOT do documentation, especially policies! You just keep telling yourself that Quote Link to comment Share on other sites More sharing options...
grahamc Posted April 2, 2008 Share Posted April 2, 2008 You just keep telling yourself that Hey, its my world, leave it be! I just really do not see the point of writing all this out, just so I can write another document for those that the original policy do not apply to. Quote Link to comment Share on other sites More sharing options...
ivan Posted April 2, 2008 Share Posted April 2, 2008 Just one of the reasons I escaped the IT ratrace. Quote Link to comment Share on other sites More sharing options...
Schtuv Posted April 2, 2008 Share Posted April 2, 2008 Documentation ... dull but necessary! I always start by creating a table of contents (for example, from http://www.iso.org/iso/support/faqs/faqs_widely_used_standards/widely_used_standards_other/information_security.htm), and working from there: This way you can properly populate links in the document as you go, and sections you can collapse or copypasta become reasonably obvious. Trawling somewhere like https://www.cio.executiveboard.com can often throw up 'comparison' documents, that you can 'use as a guide' when making yours. Running a dual-head display makes this a lot easier ... EDIT: BCS probably have a standard policy document set in their library - I wouldn't know, though, as I've never joined. Don't forget to make it all ITIL compliant, too ;-) Quote Link to comment Share on other sites More sharing options...
Schtuv Posted April 2, 2008 Share Posted April 2, 2008 ... and don't forget to set yourself 'documentation' goals, such as; - At least one white-font-white-background section of text - Make up your own funky acronym, add it to the document, and see if it catches on - Add a pr0n jpg, resized to 1x1 pixel size (and make sure 'reading' layout doesn't unhide it) - At least once end a sentence with the phrase ", like the voices told me". If no-one ever mentions this, you can be sure that either the documentation hasn't been read, or everyone already thinks you're ready to be sectioned. Some years down the road you can mention this to your subordinates and co-workers. They'll actually go back and read your documentation to try to find the above items Quote Link to comment Share on other sites More sharing options...
edd_t Posted April 3, 2008 Author Share Posted April 3, 2008 Documentation ... dull but necessary! I always start by creating a table of contents (for example, from http://www.iso.org/iso/support/faqs/faqs_widely_used_standards/widely_used_standards_other/information_security.htm), and working from there: This way you can properly populate links in the document as you go, and sections you can collapse or copypasta become reasonably obvious. Trawling somewhere like https://www.cio.executiveboard.com can often throw up 'comparison' documents, that you can 'use as a guide' when making yours. Running a dual-head display makes this a lot easier ... EDIT: BCS probably have a standard policy document set in their library - I wouldn't know, though, as I've never joined. Don't forget to make it all ITIL compliant, too ;-) i think its the BCS templates we are working to, and this is all to do with ITIL or COBOL or some other crappy acronym... ... and don't forget to set yourself 'documentation' goals, such as; - At least one white-font-white-background section of text - Make up your own funky acronym, add it to the document, and see if it catches on - Add a pr0n jpg, resized to 1x1 pixel size (and make sure 'reading' layout doesn't unhide it) - At least once end a sentence with the phrase ", like the voices told me". If no-one ever mentions this, you can be sure that either the documentation hasn't been read, or everyone already thinks you're ready to be sectioned. Some years down the road you can mention this to your subordinates and co-workers. They'll actually go back and read your documentation to try to find the above items Thats brill i'll be trying some of them out Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.