Anuj Dube Jimmy Lambert Michael McClendon Security Policy Anuj Dube Jimmy Lambert Michael McClendon

Clean Desk Policy First line of defense General : Clear desk of papers Extreme: Clean entire workspace

Account Management Policies Centralized - Database Decentralized – Individual workstations and servers Two account rule

Account Management Policies Disabling/Deleting accounts Termination Leave of absence Time-of-day

Portable Device Policies General: USB/Flash drives Extreme: Mobile phones

Internet Usage Policy Goal: ensure maximum employee productivity and to limit potential liability to the organization from inappropriate use of the Internet in a workplace

Password Policy Components: Password construction Reuse restrictions Duration Protection of passwords Consequences

Insider Threat Top network security risk!!! What is it? Damage by current or former employees. The insider threat is often discussed among the top information security risks facing organizations. In fact, for the first time in seven years of doing the study, the 2012 Ponemon Data Loss survey listed internal mistakes by insiders is the number one cause of data breaches. What is an insider threat? This term is loosely used to describe current or former employees doing damage to the organization.   These can be malicious actions, such as stealing confidential information, or accidental, such as sending confidential information in an email attachment.

Personnel Policies Acceptable Usage Policy Mandatory Vacation Policy Separation of Duties Policy Job Rotation Policy Personnel security is an extremely challenging area of security.  In order to function, an organization must allow access to sensitive data.  But in an instant, a trusted employee can become an attacker. So in order to keep a check on any such harmful advances there are certain personnel policies that an organization must follow.

Acceptable Usage Policy (AUP) What? Set of rules Why? Reduce the potential for legal action How? New members sign AUP before provided with restricted information An acceptable use policy (AUP), also known as an acceptable usage policy or fair use policy, is a set of rules applied by the owner or manager of a network, website or large computer system that restrict the ways in which the network, website or system may be used. AUP documents are written for corporations,[1] businesses, universities,[2] schools,[3] internet service providers,[4] and website owners,[5] often to reduce the potential for legal action that may be taken by a user, and often with little prospect of enforcement. Acceptable use policies are an integral part of the framework of information security policies; it is often common practice to ask new members of an organization to sign an AUP before they are given access to its information systems. For this reason, an AUP must be concise and clear, while at the same time covering the most important points about what users are, and are not, allowed to do with the IT systems of an organization.

Mandatory Vacations Policy What? Use vacations at specific times of the year Why? Detect security issues with employees How? Someone else perform same duties Mandatory vacation policy requires employees to use their vacations at specific times of the year or use all of their vacation days allotted for a single year. This policy helps detect security issues with employees, such as fraud or other internal hacking activities, because the anomalies might surface while the user is away. For a mandatory vacation to be effective as a fraud deterrent and detection tool, someone else must be cross-trained and must perform the work during the mandated vacation. An employee who never takes a day off may be a red flag for fraud. Employees who engage in fraud may resist taking a vacation, fearing that someone else doing their job in their absence may discover the irregularities.

Separation of Duties Policy What? Restrict power to prevent fraud by an individual Why? Principle of least priviledge How? Information flow diagram Separation of duties is a classic security method to manage conflict of interest, the appearance of conflict of interest, and fraud. It restricts the amount of power held by any one individual. It puts a barrier in place to prevent fraud that may be perpetrated by one individual. The technology group should understand the basic separation of duties issues within the technology area as well as the principle of least privilege. To be certain that you have identified all separation of duties issues, you will first need to create an information flow diagram for every function within each area of the organization.dividual. It puts a barrier in place to prevent fraud that may be perpetrated by one individual.

Job Rotation Policy What? Systematic movement Why? Orientating, training, prevent burnout, prevention from fraud How? Information not isolated just one employee Job Rotation is the systematic movement of employees from one job to another within the organization as a way to achieve many different human resources objectives such as orienting new employees, training employees, enhancing career development and preventing job boredom or burnout.