Network Security Policy Practices Every company or corporation with a computer network that has valuable assets stored has a well planned network security policy in place. A network security policy is defined as a manuscript that defines the regulations for computer network admission identifies policies and how they are enforced, and gives a basic layout of proper security procedures. Without a policy to prepare, prevent and respond to security breaches, reliability of the network could be compromised. Basic beginning steps to implementing a security policy, or preparing, include accessing the jeopardy to the network and creating a response panel. Next we look at the continuation, or prevention, of the network which consists of monitoring the network for violations and a security change management practice for when the policy needs to be updated. The final step for the policy is the review process which goes over past events and incidents, and implementing modifications to the existing policy to adapt these breaches. Each of these steps is essential to the integrity and continuation of a secure network and must be subject to constant observation and change. New types of viruses and attacks are dreamed up on a daily basis, and we need to be prepared to prevent and respond as quickly as possible in order to provide network availability to company employees and needs. Preparation is the groundwork in handling the security measures for a security policy and provides a starting point for an IT team to work with. The preparation stage includes three main components: construction of a usage policy, completion of a risk analysis, and creating a security team. When the usage policy is created, it states each user group and its roles and duties with regards to the network’s security. This can start out as just a broad policy that breaks down the users into specific groups. The first group will be the general, or basic, user group which has a general comprehension of the policy, the purpose it provides, and outlines how to improve security and security duties. In other words, this group is usually reserved for non-IT users that do not have any administrative authority to network systems. Any operations that can result in disciplinary action against an employee are clearly defined, as well as how to avoid said action, in the usage policy. The next usage policy to establish is a partner acceptable use statement, which outlines the information accessible to the group, expected discloser of such data, and the conduct of the staff. Also explained in this statement are specific attacks that have been identified as security threats and the discipline that will result if an attack is detected. The last acceptable use statement is the administrator, which defines the measures for other user account administrative tasks, privilege review, and enforcement of policies.
After the usage policies are defined and in place, the next order of business is to identify hazards to any and all parts of the network to include its resources and archived information. The risk analysis is intended to address sections, provide a threat rating to the individual sections, and implement a specific level of protection. This will provide a balance, or check sum, among security and necessary accessibility to the network. The three risk categories for the analysis are low, medium, and high risk priorities. Low risks describe that the systems or data that have been corrupted will not hinder normal activities or be the cause of any financial or legal situations. When a medium risk is placed on equipment or data, there is a good chance that it will cause a reasonable interruption to business, slight legal or financial situations, and could lead to further access to other systems within the network. The target area will most likely require moderate effort to restore the system or data integrity within the network. The last and most dangerous risk level is high, which describes the equipment or records will reason severe interruption in production, rigorous financial or legal problems, provide a way to access other systems, or even threaten the well-being of personnel. The besieged system or information would call for a swift and considerable attempt to reverse the damage that has been done. Some examples of systems that need to be assigned risk intensity include: core network devices, distribution network devices, network security devices, access network devices, e-mail systems, desktop computers, all servers, ECT. Such devices that can cause extreme disruptive failure need to be recorded as a medium or high risk device include: switches, DNS servers, DHCP servers, and routers because of the corruption of these devices can cripple the entire network. Once the risk levels have been assigned, the types of users that will be using the systems need to be identified. There are 5 common users that are established by most companies, which are as follows: 1. Administrators are internal users that are responsible for network resources a. Are responsible for configuration of high risk systems and usually have access to all system administrative actions. 2. Privileged are internal users that need greater access than general users 3. Users are internal users that need only general access to systems 4. Partners are external users with need to access some resources 5. Others are external users or customers
The last stage of prevention is establishing a structured security team. This is a multi capable security squad that is guided by a Security Manager, and is comprised of members from the individual sections of the organization’s operational areas. These representatives need to be conscious of the security policy as well as the basic technical aspects of the network blueprints and implementation. Practices include the actual risk analysis, as oppose to review, the consent of security amend needs, and the reviews all security infractions. Finally the last area of the team structure is the response group. These individuals do the physical trouble shooting and correction of violations, while monitoring the network, which usually involves virtual machine software to provide a real time picture of what is happening. Each member should know individual responsibilities and the team’s as a whole, as defined by the security policy.
Once the preparation stage has been established, the next major step in creating the security policy is the prevention section. This stage can be described as two distinct measures, which are the approval of security modifications and monitoring the network for security violations. Security amends can be described as modifications to network equipment that prove to have a positive impact on the collective security of the network. Every organization will have their own set of unique requirements and need to be written in non-technical terms so that non IT members can easily understand the policy. After reviewing specific network configuration and design issues the team can create and implement required changes to the security policy. The security team does not necessarily need to review all changes but the gaps in security that generate enough risk to the network will receive a priority in implementation. Some examples that the team review include any changes in the following: access control lists (ACL), Simple Network Management Protocol (SNMP) configuration, firewall configuration, and software which is different as of the accepted software alteration catalog. Also a few guidelines that are good to go for network devices are changing passwords regularly, restricting access to an accepted record of persons, and ensuring that software of devices are in regulations with the security configuration requirements. Usually a security team representative will attend change management approval meetings to monitor all changes and deny changes that are not permitted by the security panel.
The other section of the prevention stage is the monitoring of the network security. This can be thought of as comparable to network monitoring, except it is centered on detecting changes in the network that can pose a security threat or violation. With the risk analysis and establishment of approved security changes an idea can be developed on what needs to be monitored and how often. The high risk network devices, such as firewalls, need to be monitored in real time, while others do not necessarily need such monitoring techniques. The security policy ought to define the manner in which the security team is alerted by infractions. Usually the network software initially discovers an infringement and alerts the operation center. The security team is then informed, by pager for example, to go out and resolve the situation.
The last stage of creating a network security policy is the response to security threats and violations. The response stage is dispersed into three distinct parts which are security infringements, restoration, and evaluation. When a breach or violation is discovered, a quick decision can be the determining factor for the ability to defend network equipment, knowing degree of the damage, and recovering back to ordinary function. Having a policy to respond to intrusions helps make decisions ahead of time, this will make the recovery process much more manageable. As soon as the violation is noticed, the security team is notified and follows the security policy to handle the situation. Once the team is aware of the attack, they must decide on what corrective actions should be taken in order to stop and repair the damage. Some basic actions for response is implementing changes to prevent further attacks, isolating effected systems, contact ISP provider to trace attack, use of records to collect evidence, contact authorities, restore systems according to priority list, and notifying management and other authorized personnel. Next any changes able to be carried out with no executive consent in the security policy must be carefully detailed. To verify the degree of the breach, records of the incident such as network packet traces, duplicates of log records, catalog of modern user accounts and system connections must be made. Also to isolate compromised systems disable inactive accounts, terminate network equipment and disconnecting from the internet can limit the damage. Backing up the systems files of the compromised equipment so that a thorough examination of the damage and technique of assault in addition to looking for further symptoms of corruption is the next step. Maintaining and reviewing security device and network monitoring log files is a couple of the final actions to acquire clues to how far the violation has gone. If legal action is a possibility, then have a legal division review the data and work with law enforcement to take action.
The restoration stage of responding to a violation is the return of typical operations and is the main and ultimate objective of any breach in defense. The security policy should be followed in order to carry out, secure, and create standard duplicates. Because every system has its individual measures for backups, the policy must be flexible in explaining how each system should be handled. Finally, detailing all system security environments that call for reinstatement from the backup endorsement is necessary to restore the integrity of the network and systems.
Review is the final step in the response stage and final step in the whole security policy practice. The three objectives that need review are policy, posture, and practice. One major aspect of a security policy is to understand that it is a living document that needs constant change and modification to keep it current and continue to protect the network. To help ensure this, constant review of the policy against known best practices, is a must in order to keep the network up to date. Also hiring outside firms that conduct penetration testing actions against the network can provide further insight to vulnerabilities to the network. This will analyze the overall security of the network as well as the response of the security team, which can be done on an annual basis. Practice like these will help and continue to give insight into new types of attacks and help prevent breaches against such attacks.
In conclusion, a good security policy includes three essential stages which are preparation, prevention, and response. The preparation stage contains building usage policy declarations, performing of a risk analysis, and the set up of a security team structure. Prevention is the approving of security adjustments and supervising of network functions. The final response stage is actions to be taken when security violations occur, restoration of the network, and review of the incidents to help prevent future attacks. These all combine to make up the much needed security policy for networks all around the world.