Printer Friendly Version

If you are trying to keep your network secure from unauthorized access, creating security policies is an exercise in understanding what needs to be secured. Security policies serve many purposes and are the foundation of your security framework.

Why Your Organization Needs Security Policies

Security policies are the foundation of your secure infrastructure. Your security policies serve as a guide and a reference point to numerous security tasks in your organization including:

• Securing applications
• Configuring user access controls
• Defining management duties and responsibilities
• Assuring standardization and consistency
• Retaining confidential and proprietary information
• Designing enterprise architecture
• Mitigating risk
• Responding to security incident investigations
• Disciplining employees for breach of policy
• Minimizing liabilities to customers and shareholders
• Assisting auditors in understanding security intentions
• Establishing a sense of awareness and training
• Avoiding disputes with different technical teams
• Expediting procurement and deployment of new systems

Security Policy Basics

Security policies are high-level laws of the land regarding your security infrastructure. They are not procedures. (Procedures tell you how to implement security policies.) Upper management needs to hold someone accountable for drafting the security policies, overseeing their review, and implementing them. Without support from upper management, security policies often fall by the way side and never get written, understood, or implemented. The person being held responsible for security policies could be the Director of Information Security, the Chief Security Officer, the Director of Information Technology, the Chief Information Officer, or a knowledgeable employee appointed to be the information security officer.

Security is typically distributed, and security mechanisms should be built into all layers of the enterprise infrastructure. Security policies should describe the rules of the road for the following types of technology systems:

• Encryption mechanisms
• Access control devices
• Authentication systems
• Virtual Private Networks (VPNs)
• Firewalls
• Messaging systems
• Anti-virus systems
• Web sites
• Gateways
• Mission critical applications
• End-user desktops
• DNS servers
• Routers and switches

Some products and modules built into operating systems are designed specifically to configure and enforce security policies. Windows 2000 uses security templates (also called .inf files) to automatically configure security policies on servers and desktops. There are also third-party enterprise management tools that are designed specifically for security policy configuration, distribution, and enforcement. These products should undergo a thorough evaluation and analysis process before expensive procurement decisions are made.

Security controls are mechanisms put into place to enforce security policies.