Security Policies & Standards Flashcards
What is a Security Policy?
A security policy is a large document made up of many subdocuments that defines the company’s security strategy. It is a document that defines all the rules in the organization that all personnel need to follow—including users, network administrators, security professionals, and the management team. It is important to note that even the security team in the organization must follow the security policy defined by the organization.
As mentioned, the security policy is made up of many subdocuments, with each subdocument covering a specific area of concern, known as a policy. These policies specify the dos and don’ts that everyone within the organization must follow. The policies are created by the security professional, but are sponsored by upper-level management. The first step to creating a security policy is to get the support of upper-level management because without their approval and support, there is no enforcement of the policy.
What is the Structure of a Security Policy?
Although it is up to you how you format your security policy and what sections go into each policy, here is a quick overview of parts that should exist in each document contained within the security policy. The following sections should be part of any security policy:
Overview: The first section is the overview section, and it should identify what the purpose of the policy is and how it helps secure the environment. For example, the password policy would specify the need to have strong passwords and secure usage of passwords.
Scope: The scope section of the policy defines who the policy applies to. For example, you should explicitly specify whether the policy applies to all employees, contractors, and/or temporary employees. You should also specify if the policy is to apply to all equipment within the organization.
Policy: The policy section is the largest section in the document and is the listing of dos and don’ts. The policy section may be divided into different parts to help organize all of the rules specified by the policy.
Enforcement: A very important part of the policy is to specify what happens if employees do not follow the policy. This section is usually a short section specifying that if employees do not adhere to the policy, it could result in disciplinary action and maybe even termination of employment.
Definitions: The definitions section is where you can add definitions for terms that are used in the policy that the reader of the policy may not know.
Revision History: The revision history is a section of the policy that lists the date the policy has been changed, who made the change, and maybe who authorized the change. Do not forget to add an entry to the revision history showing the creation date of the policy.
It is important to ensure that each policy has a consistent format. To help you create policies, visit www.sans.org and download some of their policy templates. These templates are published for you to use as a guideline when creating your own policies.
What are Security Policy Types?
Three popular types of policies are standards, guidelines, and procedures.
Most policies within an organization are standards that must be followed. A standard policy is a policy that needs to be followed and typically covers a specific area of security. Failure to follow a standard policy typically results in disciplinary action such as termination of employment.
Some policies are guidelines, which are recommendations on how to follow security best practices. The National Security Agency (NSA) has published on their web site a number of guidelines on security best practices for different types of servers and operating systems. No disciplinary actions result from not following a recommended policy because it is just that—a recommendation.
The final type of policy is a procedure policy, which documents step-by-step procedures showing how to configure a system or device, or maybe step-by-step instructions on how to implement a security solution.
What is ISO 17799?
`The International Standards Organization (ISO) created the ISO 17799 standard, which specifies best practices for information security management. ISO 17799 breaks the management of information security into different categories (typically known as domains). The following is a listing of some of the categories of information security you should be focused on to follow this standard: \+ Risk Assessment \+ Security Policies \+ Security Organization \+ Asset Protection \+ Personnel Security \+ Physical and Environmental Security \+ Communication and Operation Management \+ Access Control \+ System Maintenance \+ Business Continuity
What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) was created in 1996 and deals with the privacy of health care records. HIPAA is a U.S. standard whose key area of concern is to protect any individual identifiable health information and to control access to that information.
What is Personal Identifiable Information?
Personal Identifiable Information (PII) is any information that can uniquely identify a person. It should be protected at all times. Examples of information considered Personal Identifiable Information are the following:
National identification number: A national identification number would be something like the Social Security number (in the United States) or the social insurance number (in Canada).
Driver’s license number: A driver’s license number is a good example of unique information about an individual that would need to be secured.
What is Acceptable Use Policy?
The acceptable use policy, also known as the AUP, is an important policy because it lets the users know what the company considers acceptable use of its assets such as the Internet, e-mail, laptops, and mobile devices.
The acceptable use policy should be reviewed by all employees during employee orientation and should be signed as proof that they have read the policy and agree to its terms. The following are topics typically covered by the acceptable use policy:
Acceptable use of Internet: Typically covers rules such as prohibiting inappropriate content. You may also want to state whether the Internet should be used only for business purposes and what the company tolerance is for use of social networking sites during business hours.
Acceptable use of e-mail: This policy should cover the fact that e-mail is for business use with minimal personal e-mails. Also specify in the policy what the company rules are surrounding the topic of forwarding chain letters and that no harassing e-mails should be sent from business e-mail accounts.
Acceptable use of laptops: This policy specifies any rules surrounding the use of laptops. You may want to cover topics such as locking the laptop in the trunk of the car if it is left in the car—laptops are not to be left in plain view. Also specify if the content on the laptop should be encrypted and whether the user can connect the laptop to non-work networks.
Acceptable use of mobile devices: This policy should cover any rules surrounding mobile devices, such as the type of mobile devices that can be used for corporate mail and phone. Also specify how much personal use is allowed with the mobile device and what to do if the mobile device is stolen. Lastly, you may want to specify what features of a mobile device are to be enabled or disabled.
What is Password Policy?
The password policy is an important policy to both users and administrators. I’ve placed the password policy in the section affecting users, but note that it affects the administrators as well because it will dictate to the administrators what to configure as password restrictions on the servers and the requirements for proper passwords.
The following outlines some of the considerations that should go into the password policy:
Minimum password length: The minimum password length specifies how many characters employees must have in their passwords. The typical minimum length used by businesses is eight characters.
Password history: The password history setting specifies how many past passwords the system should keep track of. The concept here is that employees are not allowed to reuse a password in the password history. Companies typically set the history to 12 or 24 passwords.
Maximum password age: The maximum password age specifies how long an employee is allowed to have a specific password. This value is normally set anywhere from 30 to 60 days, at which time the user must change their password.
Minimum password age: The minimum password age is a minimum number of days that a user must have their password. This setting will prevent employees from changing their password multiple times in order to get the desired password out of the history with the intent of reusing an old password.
Password complexity: The password complexity setting specifies whether you require complex passwords. A complex password is a password that has a mix of letters, numbers, and symbols and uses a mix of uppercase and lowercase characters. It is highly recommended to have password complexity enabled within your environment.
What is Change Management Policy?
The change management policy will specify the process to follow when implementing a change to the network. When a change management process is not in place and the policy is not being followed, access to the asset may be denied due to mistakes in changes.
Having a change management policy that specifies procedures to follow should reduce mistakes in configuration because a process can ensure that the change will be properly tested.
What is Secure Disposal of Computers?
One of the most vital policies to consider today is secure disposal of equipment. What do you do with a computer that has been decommissioned in the business? Do you donate it to the local school system? What about the corporate data that resided on the hard drive of that system? It is important to consider what you do with systems and devices after they are taken out of production.
In highly secure environments, it is critical that you physically destroy any hard drives that held sensitive data. In less secure environments, you may want to securely wipe the drives so that the data cannot be recovered. Simply formatting a drive does not remove the information, and it still can be retrieved.
Also specify in this secure disposal of computers policy what to do with old equipment taken out of production. This includes servers, tapes, switches, routers, and mobile devices. I have seen many cases where the network administrator has sold the company’s old server or router on the Internet without ensuring that the existing data and configuration are erased. This should be a violation of the security policy, and administrators need to be educated on the risks associated with not securely disposing of equipment.
What is Service Level Agreement?
A service level agreement (SLA) is a contract, or agreement, between your company and anyone providing services to the organization. The service level agreement sets the maximum amount of downtime that is allowed for assets such as Internet and e-mail and is an important element of the security policy. It is important to ensure that you have an SLA in place with all providers, including Internet providers, communication link providers, and even the network service team.
What is Privacy Policy?
An important aspect to any organization today is to have a privacy policy in place that is used to educate employees and customers as to how and why information is collected from its customers and how that information will be used. Most businesses place a privacy statement on their web site to inform the public how they intend to use and manage that information.
What is Classification of Information?
Another example of a policy that deals with the concerns of management is an information classification policy. The information classification policy helps define the different classifications of information, for example, secret and top secret, and what clearance level is needed to access that information.
Assigning a classification level (known as a data label) to information determines the amount of effort used to secure the information. For example, information that is classified as top secret will have more security controls in place to protect the information than will information of lower classification such as secret or even unclassified.
The following are some popular information classifications used by the military:
Top secret: This is the highest classification level. Top secret is information that would cause grave damage to national security if disclosed to the public.
Secret: A classification level below top secret. Information classified as secret could cause serious damage to national security if disclosed to the public.
Confidential: A classification level below secret and the lowest classification level. Information classified as confidential could cause potential damage to national security if disclosed to the public.
Unclassified: Any information that is not classified falls into this category—unclassified. Unclassified information is considered safe and not harmful to national security if disclosed to the public.
The security policy should specify what type of information is top secret, secret, confidential, and unclassified. The policy should not only specify how information is classified, but also under what circumstances information can be declassified (the classification removed or changed) and what the process is to have that classification on the information changed.
Once the information in the organization has been classified, the next step is to assign persons within the organization a clearance level. To access top secret information, an employee would need top secret clearance and need-to-know status.
There are other classification levels that can be assigned to information. The previous examples are common with government and military, but companies may use their own internal classification system. The following are other examples of classification labels:
High/medium/low: Your company may use an internal classification system of low, medium, and high to rate the security risk if the information is exposed to the public.
Private/public: A simple approach to classifying information is to label the information as either private or public. Private means that the information is for internal use, while public is information that does not present a security risk if exposed to the public.
What is Remote Access Policy?
The remote access policy is designed to determine how remote users will gain access to the network, if at all. In the remote access policy, you specify remote access protocols that are required to be used and specific software solutions that the company has tested and approved. In this policy you may also specify that the client system must be up to date with patches and antivirus updates.
What is VPN Policy?
The VPN (virtual private network) policy specifies how remote users will connect to the network using the Internet. A VPN encrypts communication between the client and the VPN server. In the VPN policy, you will specify what VPN protocol and solution are to be used for remote access via VPN. In this policy you may also specify that the client system must be up to date with patches and antivirus updates.
