Computer Networking Fundamentals
IN THIS LESSON
Security Policies
What is a Security Policy and why is it important? Security Policies provide a foundation of directives, regulations, rules, and practices that define how each organization will manage, protect, and distribute information. Having the proper security policies in place will not only help improve a companies overall security posture but it will produce evidence of compliance.
So what are some of the most common policies every organization should have?
Security Awareness and Training Policy: Establishes your organizations requirements for raising employees security awareness and conducting the corresponding training. The policy aims to educate employees on common cybersecurity threats and ways to avoid them.
Acceptable Use Policy: Should clearly outline how your data assets, computer equipment and other sensitive resources should be handled. The goal is to restrict the unlawful and unauthorized use of information assets.
Network Security Policy: Are the rules and guidelines that define how an organization protects, manage, and monitors its network assets and data from unauthorized access, misuse, or attack. They are essential for ensuring network security, compliance, and performance.
Data Management Policy: Is a concise set of guidelines and procedures that outline how an organization collects, stores, processes, and safeguards its data throughout its lifecycle to ensure confidentiality, integrity, and availability. In addition to the CIA triad, the data management policies aide in ensuring that your business remains compliant with relevant regulations.
Access Control Policy: Are requirements that specify how access is managed and who may access critical systems or data and under what circumstances. ACP ensures the principle of least privilege by only giving the users access necessary to their direct job responsibilities.
Password Management Policy: Should outline the way the credentials of employees, contractors, and other users should be managed with the goal of maximizing security and minimizing the misuse or theft of passwords.
Remote Access Policy: Requirements for establishing secure remote access to an organizations data and systems that’s designed to minimize potential exposures to public networks and protect the network from potential security risks
Vendor Management Policy: Allows you to identify which vendors put your organization at risk and then define controls to minimize third-party risk. By enforcing a VMP, you have the added benefit of addressing supply chain issues by ensuring that vendors meet security service level agreements (SLA) and SOC 2 security requirements that is designed to protect sensitive and personal information from unauthorized access.
Removable Media Policy: Outlines rules for using USB devices in your organization and specifies measures for preventing USB-related security incidents. The policy aims to mitigate the risks of contaminating IT systems and disclosing sensitive data as a result of using portable devices
Incident Response Policy: Outlines the structured approach that an organization follows when responding to and managing a cybersecurity incident.
By enforcing the proper information security policies, you not only protect your data and critical assets, you also help your organization define and implement the proper cybersecurity controls in order to satisfy your I/T compliance requirements.
