Components of a Comprehensive Security Policy

Security Policy ComponentsДЇigure 1-14 shows the hierarchy of a corporate policy structure that is aimed at effectively meeting the needs of all audiences.ДЇigure 1-14. The goal is to ensure that the information security policy documents are coherent with its audience needs. One document will not likely meet the needs of the entire audience of a large organization. In the policy, users can be organized into two audiences: When end users know why a particular security control has been included, they are more likely to comply with the policy. However, they might want the high-level overview or the principles supporting the requirement. Managers are also not likely to be interested in the technical aspects of why a particular requirement is needed. You can assume that the technical staff already knows why a particular requirement is included. For example, you probably do not need to include a description of why something is necessary in a policy that is intended for the technical staff. The audience determines the content of the policy. However, the security policy should treat each of these groups differently. The audience for the security policy is anyone who might have access to your network, including employees, contractors, suppliers, and customers. Authorizes staff to monitor, probe, and investigate.Some sites refer to an acceptable use policy as an appropriate use policy.ДЄ properly defined security policy does the following: For example, an AUP might list the prohibited website categories. The AUP should be as explicit as possible to avoid ambiguity or misunderstanding. This component defines what users are allowed and not allowed to do on the various components of the system, including the type of traffic that is allowed on the networks. One of the most common security policy components is an acceptable use policy (AUP). The three reasons for having a security policy are as follows: Therefore, an attempt to use a set of security tools in the absence of at least an implied security policy is meaningless. It also provides a baseline from which to acquire, configure, and audit computer systems and networks for compliance with the security policy. It should specify the mechanisms that you need to meet these requirements. It informs users, staff, and managers of their obligatory requirements for protecting technology and information assets. The security policy acts as a bridge between these management objectives and specific security requirements. The security policy translates, clarifies, and communicates the management position on security as defined in high-level security principles. A security policy is a вЂњliving document,вЂќ meaning that the document is never finished and is continuously updated as technology and employee requirements change. The answers identify assets in a wide range, including critical databases, vital applications, vital company customer and employee information, classified commercial information, shared drives, email servers, and web servers.ДЄ security policy comprises a set of objectives for the company, rules of behavior for users and administrators, and requirements for system and management that collectively ensure the security of network and computer systems in an organization. What would stop your company or organization from doing business or fulfilling its mission?.What processes, data, or information systems are critical to you, your company, or your organization?.Your assets are what need the protection of a security policy.Дetermine what your assets are by asking (and answering) the following questions: Someone might want that something for himself, or he might want the satisfaction of denying something to its rightful owner. Every organization has something that someone else wants.

Security policies for mac in enterprise