Unit 1 Discussion 1: Importance of Security Policies
The important part of deployment is planning. It’s not possible to plan for security, however, until a full risk assessment has been performed. Security planning involves developing security policies and implementing controls to prevent computer risks from becoming reality.
The policies outlined in this paper are merely guidelines. Each organization is different and will need to plan create policies based upon its individual security goals and needs:
The discussion of tools and technologies in this paper is focused on features rather than technology. This emphasis allows security officials and IT managers to choose which tools and techniques are best suited to their organizations' security needs.
Developing Security Polices and Controls
A company's security plan consists of security policies. Security policies give specific guidelines for areas of responsibility, and consist of plans that provide steps to take and rules to follow to implement the policies.
Policies should define what you consider valuable, and should specify what steps should be taken to safeguard those assets. Policies can be drafted in many ways. One example is a general policy of only a few pages that covers most possibilities. Another example is a draft policy for different sets of assets, including e-mail policies, password policies, Internet access policies, and remote access policies.
Two common problems with organizational policies are: 1. The policy is a platitude rather than a decision or direction. 2. The policy is not really used by the organization. Instead it is a piece of paper to show to auditors, lawyers, other organizational components, or customers, but it does not affect behavior.
A good risk assessment will determine whether good security policies and controls are implemented. Vulnerabilities and weaknesses