Policy Development Milan Adams

Why do we need policies Tell us what to do Keep us safe Better security

IT Specific policies Email Acceptable Use Policy (AUP) Personal Identification Information (PII)

Email Policies Inform the user what he or she is allowed to email, inter-company or intra-company Inform the users of what a phishing attack is and how to identify one and report it to the IT security staff Include a stipulation about how users should react if their email account was compromised

AUP Describes the key points of special importance to users Personal use Behavioral expectations Employees should be required to read and sign

PII Include all personal information about employees How they are stored and encrypted What to do if there is a breech

PlayStation Network 2011 Confirmed around 77 million users accounts had breach Personal Identifiable Information was stolen Surpassed TJX hack Failed to notify users immediately Non encrypted information Usernames, passwords

PlayStation Network 2011 Possibly poor policy Could be why Sony delayed Didn’t know what to do No procedures in place