AdministrativeIn cyber security

Administrative-

Administrative controls are based on rules, laws, policies, procedures, guidelines, and other items that are “paper" in nature. In  essence,   administrative controls set out  the  rules  for  how  we expect  the  users  of our  environment to behave. Depending on the environment and control in question, administrative controls can represent differing levels of authority. We may  have  a simple rule  such  as "turn the  coffee  pot  off  at  the  end  of  the  day,"  aimed at ensuring that we do  not  cause  a physical  security problem by burning our  building down at night. We may also have a more stringent administrative control, such as one that requires us to change our password every 90 days. 

One important concept when we discuss administrative controls is the ability to enforce compliance with them. If we do  not  have  the  authority or the  ability to  ensure that  our  controls are being complied with,   they  are  worse  than useless,  because they  create  a false sense  of security.  For example, if we create a policy that says our business resources cannot, in any fashion, be used for personal use, we need to be able to enforce this.  Outside of  a highly secure  environment, this  can  be  a difficult task We will  need  to  monitor telephone and mobile phone usage,  Web  access,  e-mail   use,  instant  message conversations, installed software,  and  other potential areas for  abuse. Unless we were  willing to devote a great  deal  of  resources for  monitoring these  and  other areas,  and dealing with violations of our  policy, we would quickly have  a policy  that  we would not be  able to enforce. Once it is understood that we do not enforce our policies, we can quickly set ourselves up for a bad situation.