Dr. Erdal Ozkaya
Search
  • Home
  • General, Cybersecurity, ISO 2700x
  • What is IT Security Policy :0

What is IT Security Policy :0

Erdal2021-06-29T08:10:20-04:00

What is IT Security Policy ?

The essence of an IT security policy, is to establish guidelines and standards for accessing the organization’s information and application systems. As IT infrastructures have become more complex and organization’s resources have become more distributed, the need for improved information security has increased.

An IT security policy, facilitates the communication of security procedures to users and makes them more aware of potential security threats and associated business risks. A written IT security policy, helps to enhance the performance of the organization’s IT security systems and the e-business systems that they support.

Surveys regarding IT security all tend to show similar trends:

  • most organisations have been the victims of it security breaches,
  • IT security breaches cause significant damage,
  • IT security breaches are increasing,
  • insiders pose as significant a threat as outsiders.

If an organisation suffers an IT security breach it is likely to suffer negative impact. There are many costs associated with a security breach:

  • direct financial loss,
  • lost sales and reduced competitive advantage,
  • damage to organisation reputation and brand,
  • business disruption.

An IT security policy, mitigates the organisations legal exposure. The security policy guides the behaviour of employees. Having a written IT security policy, is essential if the organisation wants to be able to hold employees accountable for their actions.

An IT security policy forces an organisation to make return on investment decisions. Whilst, developing an IT security policy the organisation will have to make intelligent business decisions about the cost-effectiveness of reducing or eliminating business risks.

Developing and IT Security Policy

To develop and IT security policy a task force needs to be established and the task force will need to work through the following steps:

  • Access the requirements,
  • Identify the information assets, systems and facilities,
  • Identify the threats to the assets,
  • Assess the risks to the assets,
  • Develop an security policy to manage the risks,
  • Implement the security policy,
  • Communicate the security policy,
  • Enforce thesecurity policy,
  • Re-assess thesecurity policy,
IT Security Policy
IT Security Policy

IT Security Policy Contents

The IT security policy, should deal with security threats to the organisations information assets with respect to the following fundamental areas:

  • Authentication – ensuring a user is who he says he is,
  • Authorisation – controlling what information and applications a user can access,
  • Privacy and data integrity – preventing unauthorised users from seeing certain information, and preventing them from making unauthorised changes or deletions,
  • Non-repudiation – making sure that parties in a transaction can not deny what they said or what they did,
  • Disaster recovery and contingency planning,
  • Physical security.

In some countries today simple password only user identification schemes are considered to be inadequate. Two-factor authentication consisting of something you know (a password or pin) plus something you possess (smartcard with digital certificate) is now considered to be the norm.

The IT security policy, should have sections dealing with the following issues:

  • Access control
  • Electronic Mail
  • Internet security
  • Laptops, notebooks and handhelds
  • Software security
  • Network security
  • Physical security
  • Auditing and monitoring
  • Contingency planning

Implementing the IT Security Policy

Once the IT security policy, has be written it needs to be put in place within the organisation. It needs to be communicated to employees, contractors and other personnel to ensure that they understand the security policy and what is required.

The IT security policy, will then need to be enforced. IT and security staff will need to implement its contents. They will need to manage user accounts, passwords, group membership, two-factor authentication devices such as smartcards and digital certificates.

The rapid pace of technological change and use of the Internet mean that new security threats appear all the time. The IT security policy, will therefore need updating on a periodic basis.

IT Security Policy Summary

An IT security policy, is a formal statement of the rules that employees and others must follow when using an organisations IT infrastructure. Its purpose is to set down procedures for protecting the organisations information assets.

An IT security policy, which details a number of security procedures to minimise business risk is available below.

https://www.iso.org/isoiec-27001-information-security.html

More ISO Blog posts

https://www.erdalozkaya.com/category/iso-20000-2700x/

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *


Related Posts

Hacking Windows with BackTrack

Hacking Windows with BackTrack – Highly Effective Meth0d

Hacking Windows with BackTrack  A presentation on how Windows 7 can be hacked via the Free Back Track   Hacking Windows with BackTrack... read more
ECC CEH Hall of Fame 2021 Dr Erdal Ozkaya

EC Council CEH Hall of Fame News 2021

Shortlisted at EC Council CEH Hall of Fame I am happy to announce that I have been shortlisted to be in... read more
Future of Cyber Webinar

Future of Cybersecurity Free Webinar

Future of Cybersecurity Free Webinar Come and join us in this FREE webinar, where I will be discussing the current security... read more
CyberWeek Dr Erdal Ozkaya

CyberWeek 2020 – Free for everyone

CyberWeek 2020 Here is one more chance for you to register for one of the best Cybersecurity Events of the... read more
Incident Response in the age of cloudIncident Response in the age of cloud

New Book : Incident Response in the Age of Cloud

After many months of very hard work , finally my new book " Incident Response in the age of Cloud"... read more
Global CISO Forum Logo

Global CISO Forum -Community which is better together

Global CISO Forum The Global CISO Forum was launched on 26 May during GEC Media’s Security Symposium 2021. Anushree Dixit, Global... read more
2nd Middle East Cybersecurity Forum Dr Erdal Ozkaya

2nd Middle East Cybersecurity Forum – Free registration

Middle East Cybersecurity Forum ( 2nd  ) Critical infrastructure assets, systems, and networks, whether physical or virtual which are considered so... read more
CISO Summit Erdal Ozkaya

Middle East CISO Summit 2020 – Join for FREE

Speaking at Middle East CISO Summit I am pleased to announce that I will be speaking at CISO MAGs " first... read more

Handbook to Utilize MITRE ATT&CK Framework – Free D0wnload

 Handbook to Utilize MITRE ATT&CK Framework  prepared by Picus Security  exclusively  for the community. Download the report and learn; How to... read more
Cyber Security Symposium Africa Erdal Ozkaya

Cyber Security Symposium Africa 2019

Cyber Security Symposium Africa 2019 I am proud to announce, that I will be speaking this year in Africa's most comprehensive... read more

Categories

  • About Dr Erdal Ozkaya (300)
    • Awards (97)
    • Erdal in the news (121)
    • Feedback (88)
    • My Books (53)
    • Who is Dr Erdal Ozkaya ? (2)
  • Announcemets (305)
  • Artificial Intelligence AI (11)
  • Certification (52)
  • Cloud Computing (73)
  • Cybersecurity (325)
  • Cybersecurity Leadership (58)
  • Digital Transformation (2)
  • Financial Sector (31)
  • Forensics (17)
  • Free Events (166)
  • General (138)
  • How to …? (61)
  • ISO 2700x (12)
  • News (38)
  • Reviews (77)
    • Book Reviews (32)
    • Free E-Books (14)
    • Hardware Review (9)
    • Security Review / Reports (10)
    • Software Review (8)
  • Siber Güvenlik (17)
  • Video Tutorials (101)
  • What is new? (27)
  • Windows (30)

Recent Comments

  • Sabri Kızmaz on Finans Sektörü Odaklı Siber Tatbikat
  • celal bayar on Finans Sektörü Odaklı Siber Tatbikat
  • Erdal on Free EDR Certification Training
  • SANDEEP SHRIVASTAV on Free EDR Certification Training
  • Alicia Harlow on Core isolation Memory Integrity not available – (Get it fixed)

Archives

Dr. Erdal Ozkaya © Copyright 2023. All Rights Reserved.