Running Head: Policy Statements

1

Policy Statements Kevin Corey Western Governors University

Policy Statements

2

Internationally security techniques and standards, such as ISO 17799, establish guidelines

that organizations must implement in order to maintain information security. Information must be protected from those without a readily need to know to perform organizational business functions. Unauthorized access to information can have a detrimental impact on an organization from a legal and operating perspective. One of the primary preventive controls that provide an organization with many operational benefits is continuous log management policies. In addition to helping solve network security related issues, logs can be extremely beneficial in identifying unauthorized access and behaviors. Security logs assist in identifying policy violators, fraudulent behavior, real time operational problems, and provide necessary data to perform auditing, transaction back tracking and forensic analysis. In addition to the many benefits of having policies in place for continuous log analysis, standards and regulations have increased business awareness of the requirements for archiving and reviewing system logs as part of daily continuity. Some of the influential regulations that reference log management and other information security task include the following. •

Federal Information Security Management Act of 2002 (FISMA) requires entities to ensure the development and execution of organizational processes and internal controls designed to secure information systems. Health Insurance Portability and Accountability Act of 1996 (HIPAA) encompasses information security benchmarks for protecting consumer health information. Violation Penalties can range from $100-$1.5 million per violation and 1year-10year criminal sentences. ISO 17799 is an audit checklist