Developing a Network Security Policy By: Chris Catalano

Security Policy? Definition: – A security policy is a formal statement of the rules through which people are given access to an organization’s technology, system, and information assets. The Need for Security Policy:

Purpose The primary purpose of a security policy is to inform users and staff the requirements for protecting various assets Another purpose is to provide a baseline from which to acquire, configure, and audit computer systems.

Key Principles Ensure the confidentiality of the customer’s and your processed data, and prevent unauthorized disclosure or use. Ensure the integrity of data processing operations and protect them from unauthorized use.

Designing Your Policy

Things to Consider In the designing of a policy you need to figure out what you’re actually protecting All data should be considered confidential The cost of keeping things secure shouldn’t be greater than the data/objects value.

Who to Consider Depending on what you or your company does is going to determine who your threat is Design your security and policy around that threat Most corrupt activity involves someone inside the company or organization these people are classified as insiders Threat also could come from outsiders

Protecting Against Insiders Spread who has access throughout different people Layer the employees roles Monitor activity

The Outsiders Realizing what they’re after Protecting against Social Engineering

Digital Security Layered security Security requests Limiting access

Physical Security ID cards Personalized Access to rooms Security Cameras Centralized Data Centers

Acceptable Use Policy This tells the users what they can access on the internet What the can and can not do at work Can vary depending on the workplace

Backup and Recovery What is backed up and how frequent? Is it backed up onsite, offsite, or both? Managing the backups

Enforcing Your Policy Copies and documentation Followed strictly What are the punishments for not following the policy

Policy Management Revaluate your policy Ask the company for concerns regarding the current policy

Incident Response Plan This is crucial to the “What If” of a security policy This involves who gets called for what, who is authorized to shut things down, and who represents this for the company

Summary Every company or organization needs to have a network security policy. This keeps the company organized, focused, and ready for the worst case scenario. Key things to remember are people. Those people are the threat as well as the people with authority. Also you want to keep you policy flexible to strict of a policy it won’t be followed and not strict enough it won’t serve its purpose