Administrative Controls

•How do Administrative Controls demonstrate "due care?"
Administrative Controls demonstrate “due care” by providing and following policies, procedures, and standards that allow a company to show that steps were taken to protect the network and or information that is hidden by a responsible parties. It is critical that the CIA (Confidentiality, Integrity and Availability) is vital in protecting data that companies have of its customers. Due care is defined by the Information Systems Audit and Control Association (ISACA) as:
2.1.1 The standard of “due care” is the level of diligence which a prudent and competent person would exercise under a given set of circumstances. “Due professional care” applies to an individual who professes to exercise a special skill such as information system auditing. Due professional care requires the individual to exercise that skill to a level commonly possessed by practitioners of that specialty.

2.1.2 Due professional care applies to the exercise or professional judgment in the conduct of work performed. Due care implies that the professional approaches matters requiring professional judgment with proper diligence.
Despite the exercise of due professional care and professional judgment, situations may nonetheless arise where an incorrect conclusion may be drawn from a diligent review of the available facts and circumstances. Therefore, the subsequent discovery of incorrect conclusions does not, in and of itself, indicate inadequate professional judgment or lack of diligence on the part of the IS auditor. (Information Sys)
Administrative Controls and due care should go hand in hand. One cannot hope to demonstrate due care without having the proper administrative controls such as a good Information Technology protection plan. An example of an administrative control is when a company wants you to change your password every 90 days and has a combination of 14 letters, numbers and symbols password that protects against dictionary attacks. The emergence of asking a question before you type a password to get into your bank account is a form of a policy and procedure showing that a company attempted a form of due care. The lack of administrative controls will negatively affect the corporation. They will have a huge liability if they did not offer any controls to protect the network and the customer’s information. Without the lack of administrative controls then that shows that there were not and due care taken. This provides a good door to be open for corporate law suits. With all of the different laws and regulations at the federal level such as Health Insurance Portability and Accountability Act (HIPAA), The Family Education Rights and Privacy Act (FERPA), and Sarbanes Oxley (SOX) it would be a pure act of negligence if a corporation avoided administrative controls for due care. Without any administrative controls it shows a blatant lack of consideration for your customer’s information and privacy.
•How do Administrative Controls influence the choice of Technical and Physical Controls? The policies, procedures and best practices are influence the technical and physical controls. Administrative controls guides the corporations on what must be done in order to protect the network. When those policies are implemented you get things like the gold standard or a base line image. A company will know that this image can be patched or does not have any security weaknesses at the moment it was created. Policies will be in place created by administrative controls that will state that scans will be done on computers and if an information assurance vulnerability assessment (IAVA) is found on the system then it will be patched with an update. If it cannot be patched then they may quarantine it until it can be repaired. Some physical controls work with technical controls. If a computer is off of the network for a certain period of time then they will not let the employee physically connect the computer back on the network until it has been scanned for any viruses thus protected the network and customers information from possible malware attacks. An Intrusion Detection System is a technical control, it detects when someone infiltrates a system and this gives the defenders on the system a warning that something has gone wrong. The policies or procedures that company could take for physical controls could limit access to certain areas by a sign or common access card (CAC). This physically stops people from entering sensitive areas or to computer systems that may hold valuable information. Physical controls include locks, barriers, mantraps and even location specific controls.
•How would the absence of Administrative Controls affect projects in the IT department?
The absence of Administrative Controls would affect the projects in the IT department by creating a wild west of planning. For example if you were to plan installing secret internet in a building without following any administrative controls, there is a good chance that it will not be in compliance with Chief Information Office and would probably fail an inspection. This happened to a company that I used to work for. They spent a lot of money on installing the cables but they had to have the right type of Protective Distribution System (PDS). The higher authorities will not turn on this specific internet the policies were not followed. In some places you may get far enough to install of complete some parts of the project however eventually if the project is large enough then you will get penalized and have a faulty system that should really not be in operation. You may have spent millions of dollars on something that is not even compliant with current laws and open yourself up to lawsuits if it could be proved that you did not take proper due care and if you did not have administrative controls in place before you started an Information Technology project.

References
Administrative controls-lecture. (n.d.). Retrieved from http://www.devryu.net/re/DotNextLaunch.asp?courseid=8667805&userid=2180995&sessionid=e44a8b3d0a&tabid=8SYJe0ytNKmuZiBnS6/1Iv4aM1sBUKkIIMARSCLlwPu9IzXCRecSN0IzdxJEwgC&sessionFirstAuthStore=true&macid=pcMJlvDH657/SeG7FxJmuP4oiZRtCTGb4UBFW7WdYd89IM1d0fvynK3q/x91BQ4SrlsC5s6c4rephksP5fzlK0KkGg9UQM8oOh33muetKsVsVjLv9ksurHzQmpZpeF3FxynMhgJfEihpEKomwd/FVLL4x6LWzWVW9DTg6gqj5AySVW41gMxHV0hcxSKRmsPDUHZsUy6Cf1FzJddTTMJc5TmkXzHpzgh/rwCAE57aZs=
Cantrell, B. (n.d.). Due care in the computing environment. Retrieved from http://www.giac.org/cissp-papers/142.pdf
Information Systems Audit and Control Association (ISACA) http://www.isaca.org/ContentManagement/ContentDisplay.cfm?ContentID=18550
Northcutt, S. (2009, September 1). Security controls. Retrieved from http://www.sans.edu/research/security-laboratory/article/security-controls
U.S. Department of Agriculture, Food Safety and Inspection Service. (2012). System and information integrity (1306.6). Retrieved from website: http://www.fsis.usda.gov/wps/wcm/connect/5f23b121-3b79-448d-8f7a-b0ec4f6596fc/1306.6.pdf?MOD=AJPERES