1. Server Security Policy
By Thomas Jenkins

2. Background
This policy is created to keep a companies files and data safe.
It is made up of rules and regulations that regulate the use of the company’s servers and internal networks.
All employees of that company must follow this policy.
If policy is upheld, it will keep their servers secure.
Each individual company creates their own policy.

3. But, SANS provides a policy that they think is the best way to keep a server secure.
SANS makes this policy available on their website and will allow a company to put their name in the policy and adopt it.

4. Server Security Policy:
1.0 – Purpose
- The purpose is to establish standards for the configuration of server equipment. This policy will limit unauthorized access to the company’s information.
2.0 – Scope
- This scope tells what company falls under this policy and what equipment used also falls under this policy.
3.0 –Policy

5. 3.1 – Ownership and Responsibility.
- There should be a group that runs the server for said company. They should monitor it and keep it up to date.
3.2 – General Configuration Guidelines.
- Guidelines that the administrator group should follow while configuring the server.
3.3 – Monitoring.
- Server should be monitored for security issues and these issues should be recorded. Security issues should be reported to management and resolved.

6. 3.4 – Compliance.
- Audits will be performed on a regular basis to make sure server is running correctly. Findings will be reported to support staff for remediation or justification.
4.0 – Enforcement.
- Any employee found violating this policy may be subject to disciplinary action, up to and including being fired.
5.0 – Definitions.
- DMZ- demilitarized zone- A network segment external to the corporate production network.
- Server-.

7. 6.0 – Revision History.
- History of all revisions will go here.