Module 2: Creating a Plan for Network Security

Overview Introduction to Security Policies Designing Security by Using a Framework Creating a Security Design Team

Lesson 1: Introduction to Security Policies What Are Security Policies? The Relationship Between Policies and Procedures Typical Reasons Why Security Policies Fail? Guidelines for Creating Policies and Procedures

What Are Security Policies? Security policies: Are documents Explain how an organization implements security Are documents Explain how an organization implements security Administrative Policies Technical Policies Physical Policies

The Relationship Between Policies and Procedures Policies describe what must be implemented to secure a network Procedures describe how to implement policies

Security policies often fail because they are: Typical Reasons Why Security Policies Fail Not enforced Difficult to read Difficult to find Outdated Too vague Too strict Not supported by management Not enforced Difficult to read Difficult to find Outdated Too vague Too strict Not supported by management

Guidelines for creating a security plan include: Write clear and concise policies Write simple procedures Obtain management support Ensure employees can find and refer to them easily Ensure no disruption to business processes Use technology to enforce Ensure consequence of violating policy is consistent Create incentives for following security policies Write clear and concise policies Write simple procedures Obtain management support Ensure employees can find and refer to them easily Ensure no disruption to business processes Use technology to enforce Ensure consequence of violating policy is consistent Create incentives for following security policies Guidelines for Creating Policies and Procedures

Lesson 2: Designing Security by Using a Framework What Are the Benefits of MSF When Designing a Security Plan? The Envisioning Phase for Network Security The Planning Phase for Network Security The Developing Phase for Network Security The Stabilizing Phase for Network Security The Deploying Phase for Network Security

What Are the Benefits of MSF When Designing a Security Plan? The Envisioning Phase The Planning Phase The Developing Phase The Stabilizing Phase The Deploying Phase Vision/Scope ApprovedScope CompletePlans ApprovedRelease ReadinessDeployment Complete Microsoft Solutions Framework

The Envisioning Phase for Network Security Tasks when envisioning a network security plan: Assign team members Draft and circulate a vision/scope document Assign team members Draft and circulate a vision/scope document Envision

The Planning Phase for Network Security Tasks when planning a network security plan: Create a functional specification Model threats Create a risk management plan Create a development and test environment Create a functional specification Model threats Create a risk management plan Create a development and test environment Plan Envision

The Developing Phase for Network Security Tasks when developing a network security plan: Complete a proof of concept Create internal drafts of the network security plan Complete a draft network security plan Complete a proof of concept Create internal drafts of the network security plan Complete a draft network security plan Develop Plan Envision

The Stabilizing Phase for Network Security 5 5 Tasks when stabilizing a network security plan: Complete all pre-production tests Create a release candidate network security plan Complete all pre-production tests Create a release candidate network security plan Stabilize Develop Plan Envision

The Deploying Phase for Network Security Tasks when deploying a network security plan: Train the operations team Implement the network security plan Train the operations team Implement the network security plan Envision Plan Develop Stabilize Deploy

Lesson 3: Creating a Security Design Team Core Team Members Extended Team Members Guidelines for Creating a Security Design Team

Core Team Members RoleResponsible For Product Management Developing and executing the business case Ensuring that the security design aligns with business requirements Identifying and prioritizing risks Aiding communication Program Management Driving the overall project Managing the strategic goals, budget, schedules, and resources Development Designing, building, and testing security measures Testing Piloting testing Setting metrics to ensure quality control User Experience Driving the usability requirements Designing and developing training

Extended Team Members RoleResponsible For Executive Sponsor Approving recommendations by the security design team Advocating with upper management Legal Advising the team about local, national, and international laws and liabilities Human Resources Ensuring that security policies do not conflict with employment laws Managers Enforcing security policies End Users Providing feedback about the security policies Auditors Ensuring compliance with government or industry regulations

Guidelines for creating a security design team include: Have a single executive sponsor Use an experienced program manager Involve teams that deploy and manage security Involve legal and human resources Involve managers and end users Provide clear roles and responsibilities for all members Communicate regularly and clearly Have a single executive sponsor Use an experienced program manager Involve teams that deploy and manage security Involve legal and human resources Involve managers and end users Provide clear roles and responsibilities for all members Communicate regularly and clearly Guidelines for Creating a Security Design Team

Lab: Creating a Plan for Network Security Exercise 1 Identifying Reasons Why Security Policies Fail Exercise 2 Determining the Members of a Security Design Team