RE: Security policy

My suggestion would be to first look at the overall security policy in
place. Ensure that your IT policy reflects that same level and emphasis
of security. Then divide up separate security policies for the major
areas (Firewall, acceptable use, access, etc.)

Each policy should be between 2 and 3 pages long. They should cover the
overarching concepts but should be technology independent

example:
"The system shall be protected by a firewall" -technology dependent

"The system shall be protected from outside the domain" -technology
Independent

Then under each policy, develop a standard that addresses the technology
and the specific implementation of technology to accomplish the goal of
the policy. This way, the policies, which require high level (CISO, CSO
or CEO) approval are not altered very often whereas the specific
implementation can be controlled at the Security analyst/architect level
and can change regularly while still fulfilling the objectives of the
enterprise as stated in the policy.

A good source for information for the documents is NIST. There are also
companies who specialize in developing policy, standard and instruction
templates that you can purchase and create from there. A great place to
go for free stuff are the government agencies since none of their
documents are copyrighted. If you go to
http://www.e-publishing.af.mil/pubs/majcom.asp?org=AF you can see all
the Air Force policies and procedures (focus on areas 31 and 33 for what
you seek). And there are many other government agencies (federal, State
and local) that have all their policies published and available for
public consumption on line.

Good luck


Jens

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Francois Yang
Sent: Tuesday, October 24, 2006 2:39 PM
To: security-basics@xxxxxxxxxxxxxxxxxxxxxxx
Subject: Security policy

Can anyone please point me in the right direction.
I need to write some security policies, but I'm not sure where to begin.
I know there are alot of examples and templates out there, but what do
I include in the policy.
I see seperated policies for e-mail, password, remote access,
acceptable use, etc...but I was also told that it is better to try to
make all of those fit into one so that we don't have to keep track of
10 different policies. The question is, which one do I include in one
big security policy and which ones to I make them seperate?

thank you.

------------------------------------------------------------------------
---
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic
Excellence
in Information Security. Our program offers unparalleled Infosec
management
education and the case study affords you unmatched consulting
experience.
Using interactive e-Learning technology, you can earn this esteemed
degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
---



---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------

Relevant Pages

  • Re: Least User Priviledges for Network Administrators
    ... It makes sense to have a chain of command and approval policy to keep things ... the computer use policies, software purchasing policies, security ... upper management--both within the Network Technology group, ... driving the process of tightening down security. ...
    (microsoft.public.windowsxp.security_admin)
  • RE: [fw-wiz] PIX vs Checkpoint vs Sonicwall vs Netscreen - comme nts?
    ... All NetScreen appliances rely on custom-designed ASICs (Application ... Specific Integrated Circuits) for security policy enforcement. ... supports a finite number of "rules" or "policies". ...
    (Firewall-Wizards)
  • RE: Mass Distribution of Security Policies
    ... It could start with a Network usage agreement, (Advisory Policy) to all ... Mass Distribution of Security Policies ...
    (Security-Basics)
  • Re: Question for Roger Abell
    ... may have been one about how to imprint the same local policy ... Notice that "local security ... I notice that my Local Security Policy contains Account Policies, ... The security template only contains Account Policies (which ...
    (microsoft.public.windows.group_policy)
  • Fwd: Oh Dear, Where to start?!
    ... It seems to me you need two things: an organizational policy, ... finish college and break into the real world of computer security. ... experience in the field of network security and policy ... updates, driver updates, and recommended updates. ...
    (Security-Basics)