Internal Company Network Policies
Part 2: A framework for your IT procedures.
In our last edition of the journal, part 1 touched on the need of your company to have a good internal network policy for your employees and the need to enforce it. In this part we will touch on just how you go about doing that.
Is it a Policy, a Standard or a Guideline?
We frequently hear people use the names "policy", "standard", and "guideline" to refer to documents that fall within the policy infrastructure. We are focusing in on “policy” for our discussion.
A policy is typically a document that outlines specific requirements or rules that must be met. In the information/network security realm, policies are usually point-specific, covering a single area. For example, an "Acceptable Use" policy would cover the rules and regulations for appropriate use of the computing facilities.
This is different from a standard which is typically a collection of system-specific or procedural-specific requirements that must be met by everyone. For example, you might have a standard that describes how to harden a Windows workstation for placement on an external (DMZ) network. A guideline is typically a collection of system specific or procedural specific "suggestions" for best practice. They are not requirements to be met, but are strongly recommended. Effective security policies make frequent references to standards and guidelines that exist within an organization.
A Security Policy indicates senior management’s commitment to maintaining a secure network, which allows the IT Staff to do a more effective job of securing the company’s information assets. Ultimately, a Security Policy will reduce your risk of a damaging security incident.
What is right for me?
The most important thing to remember when starting the process of developing a Security Policy is that there is no “right” or “wrong” way to go about it. No one policy will work for every organization. There is no generic template that will meet every need. A fantastic policy for Company ABC might be useless to Company XYZ. That being said, a Security Policy must be a custom document that reflects your company’s specific security needs. In fact, a useless Security Policy is worse than no policy. Companies that boast of Security Policies thicker than a ream of paper are often the ones that have no idea what those policies say. The false sense of security provided by an ineffective policy is dangerous. The point of a Security Policy is not to create “shelfware” that will look good in a binder, but rather to create an actionable and realistic policy that your company can use to manage its security practices.
A Great Framework
Having an Information Technology framework for your company is an essential first step in how your technology is being handled internally. Thankfully there is a great framework to help companies accomplish this. The Information Technology Infrastructure Library, called the ITIL, is a tool that can help you. It is a customizable framework of good practices designed to promote quality computing services within your company. ITIL provides a systematic approach to the provisioning and management of IT services. The core parts of this framework include Service Strategy, Service Design, Service Transition and Service Operation, including incident management and security management.
Stay tuned for part 3.........
Nick Hitchcock
OSCP, CEH, CHFI, MCP
NHT Consulting
www.nhtconsulting.com
Posts
