SECURITY POLICY-

The essence of an IT security- policy is to establish guidelines and standards for accessing the organization’s information and application systems. As IT infrastructures have become more complex and organization’s resources have become more distributed, the need for improved information security has increased.

An IT security – policy facilitates the communication of security procedures to users and makes them more aware of potential security threats and associated business risks. A written IT -security policy helps to enhance the performance of the organization’s IT security systems and the e-business systems that they support.

Surveys regarding IT -security all tend to show similar trends:

• most organizations have been the victims of it security breaches,
• IT security breaches cause significant damage,
• IT security breaches are increasing,
• Insiders pose as significant a threat as outsiders.

If an organization suffers an IT security breach it is likely to suffer negative impact. There are many costs associated with a security breach:

• direct financial loss,
• lost sales and reduced competitive advantage,
• damage to organization reputation and brand,
• business disruption.

An IT -security policy mitigates the organizations legal exposure. The security policy guides the behavior of employees. Having a written IT -security policy is essential if the organization wants to be able to hold employees accountable for their actions.

An IT -security policy forces an organization to make return on investment decisions. Whilst developing an IT -security policy the organization will have to make intelligent business decisions about the cost-effectiveness of reducing or eliminating business risks.

Developing an IT Security Policy

To develop and IT -security policy a task force needs to be established and the task force will need to work through the following steps:

• Access the requirements,
• Identify the information assets, systems and facilities,
• Identify the threats to the assets,
• Assess the risks to the assets,
• Develop a security -policy to manage the risks,
• Implement the security -policy,
• Communicate the security -policy,
• Enforce the security -policy,
• Re-assess the security policy,

IT Security Policy Contents

The IT security policy should deal with security threats to the organizations information assets with respect to the following fundamental areas:

• Authentication – ensuring a user is who he says he is,
• Authorization – controlling what information and applications a user can access,
• Privacy and data integrity – preventing unauthorized users from seeing certain information, and preventing them from making unauthorised changes or deletions,
• Non-repudiation – making sure that parties in a transaction cannot deny what they said or what they did,
• Disaster recovery and contingency planning,
• Physical security.

In some countries today simple password only user identification schemes are considered to be inadequate. Two-factor authentication consisting of something you know (a password or pin) plus something you possess (smartcard with digital certificate) is now considered to be the norm.

The IT security -policy should have sections dealing with the following issues:

• Access control
• Electronic Mail
• Internet security
• Laptops, notebooks and handhelds
• Software security
• Network security
• Physical security
• Auditing and monitoring
• Contingency planning

Implementing the IT Security Policy

Once the IT security- policy has been written it needs to be put in place within the organisation. It needs to be communicated to employees, contractors and other personnel to ensure that they understand the security policy and what is required.

The IT security- policy will then need to be enforced. IT and security staff will need to implement its contents. They will need to manage user accounts, passwords, group membership, two-factor authentication devices such as smartcards and digital certificates.

The rapid pace of technological change and use of the Internet mean that new security threats appear all the time. The IT security -policy will therefore need updating on a periodic basis.

IT -Security- Policy Summary

An IT security- policy is a formal statement of the rules that employees and others must follow when using an organization’s IT infrastructure. Its purpose is to set down procedures for protecting the organization’s information assets.

An IT security- policy which details a number of security procedures to minimize business risk is available below.

Erdal 

Continue reading SECURITY POLICY – empower your knowledge N0W