Unit 1 Discussion 1: Importance of Security Policies There can definitely be a problem if an organization has no Internet use policy. Having all of the internet sites available can lead to many problems. The first of the problems is possibly downloading malware. If a user downloads a third-party software from the internet, for example, it could contain malicious code that could damage the system and/or infect the network. Another problem I see is having access to personal email accounts through the internet, as people could easily use these and transfer sensitive data to them from a personal email account, thus taking the data off-site which could potentially be used against the organization. An issue with external devices, is similar to Internet usage policy, in that the user can use this external device, like a Universal Serial Bus (USB) to take company data and copy it onto the drive which can be taken off-site , as well as potentially downloading third-party data to the drive that may contain malware. An Employee Identity policy is necessary for companies so that there is some sort of authentication necessary to log into the computers and not just anyone can access them. An example of an Employee Identification would be a Common Access Card (CAC) that has a pin associated with it, or more common, a username and password that must meet a certain complexity (ex. 16 characters minimum; 1 special character minimum). Computer use policy kind of goes alongside the Internet use policy and External device use policy. This would outline what is acceptable usage while on the computer, like no USB devices, no personal email usage, and even before then, what the user must adhere to or agree to before even being able to access the computer. With this, all four of the IT security policies are applicable to an organization. They can all greatly help out the