Computer Security Sample security policy Dr Alexei Vernitski

Sample security policy part 1: physical and physically mobile systems

Physical security Is physical security adequate? (e.g. for many companies all visitors/employees at a site require identification). Some rooms containing valuable data/resources might need additional security measures.

Disposal Ensure that systems and media are securely disposed when finished with.

Ownership Ownership of: – Equipment – Code – Data Ensure that users are under a contract such that equipment and data/software created are owned by the company and are not “stolen”, and ensure that users understand this (e.g. a contractor might write code for one company and then reuse it for another company - this is probably a form of “theft”). Have a special policy with regard to mobile systems such as laptops (what data can be stored on them, how the systems and the data on them is secured etc.)

Sample security policy part 2: user access systems

Choosing secure passwords Check when users create/change passwords that they are not obviously insecure (e.g. do not allow dictionary words, require passwords to contain a range of character types, do not allow passwords related to login name, disallow passwords that are car registration numbers) Regularly run password cracking programs on your users encrypted passwords looking for possible weak passwords.

Managing passwords Make users change passwords regularly (this stops password cracking programs from having enough time to break intercepted encrypted passwords)

Non-password security For higher security use techniques additional to or instead of password security (e.g. biometric, public key based systems)

Access rights Only give users access to systems/data/information that they really need for their role this requires a database of systems that users can connect to and when controls should be updated (e.g. a shared system password may need to be changed as soon as an employee that knew the password leaves)

Sample security policy part 3: user training

Security training Train all computer users in basic security which could include: – ways to create secure passwords – never writing down system security information (e.g. passwords) – never reveal system/computer information to anyone unless you are sure of their identity and even then only give appropriate information – never install unauthorised software on computers – never share data from sources outside the company until it has been scanned (e.g. never get a document from a USB stick from non- company source) – never connect machines directly to the Internet (many companies ban their users from connecting to the Internet from their laptops or work machines installed in their homes - instead the users have to connect to the company’s secure “virtual private network” VPN)

Personal use of computers restrict use of computer resources for personal use (this may ban users from using for personal use)

Secure configuration require users to have their virus scanners on all of the time (and personal firewalls on)

Encryption require users to send sensitive data over encrypted media

Communication inform users how they can communicate with system administrators

Further training make user computer users get (and read) regular security policy updates and attend regular training

Sample security policy part 4: secure configurations

Updating software All computers must have up to date software installed - this requires some automated updating system. However, it has to be done carefully - e.g. updating some server components can overwrite configuration files in such a way that they may run some “insecure” default configuration.

Restrictions on client machines “Lock down” client machines e.g. many companies give employees machines that have minimal external access (e.g. PCs without: USB data ports, CD-ROM, floppy drive) and configured so the user cannot install any software or configure any system settings. The user is only given the access and utilities that they really need.

Server precautions Configure server machines to only run necessary services. For servers connected to the Internet - increase the “security hardening” and assume they may be compromised and treat them accordingly (i.e. keep them separate from internal networks/computers)

Sample security policy part 5: backup

Backup securely back up data in a timely manner (e.g. daily is probably good enough for most office related tasks, but duplicates of all transactions might be needed for banking data) store backups in a different (and secure) physical location test that the backup system is actually working and storing the necessary data some servers may require backup systems ready to be deployed when needed.

Sample security policy part 6: use preventative security tools

Scanning the system Regularly scan computer systems on the network to test that they are only running necessary (and authorised) services (external security scanner) Regularly scan computer systems with “local security analysers” that check that computers are properly secured (e.g. running automatic software update tools and have reasonable configurations)

Scanning the data Scan all incoming data: remove software or data that might be infected with trojans or viruses. block unsolicited communication e.g. spam

Scanning for permissions filesystems will be scanned checking that files have appropriate permissions (e.g. you might like to check that your home directories are not “world” readable)

Sample security policy part 7: the system administrators

Employing administrators Employ “expert” staff as system administrators (and their managers) and train system administrators to a high standard expert system knowledge is only gained by years of personal experience System administrators regularly check security web-sites for the latest known system exploits. They should regularly read security s from the distributor of each operating system (and major application) that they are supporting.

Sample security policy part 8: review and test policy

Security policy review Regularly check through the site security policy this may be a simple “paper test” of policy as part of a general “quality assurance” review a more rigorous (and literally “intrusive”) technique might involve an analysis by outsider experts

Risk analysis Run a risk analysis to ascertain what parts of the policy need changing