1

Some things in policies can be good controls, but the same controls can open up vulnerabilities or can be contradicted by other controls and conditions in other policies.

What can be a good measure to prevent this?

Example: I say to my employees that no-one has the ability to access room FR1 after 7pm on Wednesday, but in the same policy I also alerted employees that everyone who can confirm a valid authorization are allowed in room FR1 until they leave, no matter what time.

This is just an example, but in reality, it is much broader than that. To be 100% clear, rules that interfere with other rules and that combination will fail because of confusion. I want to prevent these kinds of complications.

  • Yes, i want to prevent contradictions in policies – user211258 Jun 12 at 12:58
  • I tried to rewrite your question based on my understanding of what you've asked. Have I represented your question accurately? – schroeder Jun 12 at 13:06
1

Typically, you want to have your policies in a hierarchical format so that child policies support the parent policies. That's one way to ensure that you do not end up with contradictions or logic loops.

Your example is highly detailed and is more of a procedure than a policy (a minor point, but I'm going with "procedure"), but the way to prevent contradictions and logic loops in procedures is to run decision trees to track the state of the elements in the procedures. This sounds more complex than it is, but you just need to list the various elements that can have their own states (allowed, not allowed, locked, unlocked, etc.) and see if there are different conditions that can trigger different states at the same time. You start by asking, "where do I reference room FR1?" and work from there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy