Scribd Logo
Upload

Welcome to Scribd!

  • 22 views

    11) HND

    Uploaded by

    Dulanja Omesh
    This document discusses security policies, procedures, standards, and guidelines. It defines each term and explains that policies are formal statements set by management, procedures provide step-by-step instructions, standards mandate actions, and guidelines recommend best practices. The document also outlines different types of security policies an organization may have around user accounts, system access, internet usage, and software. Finally, it summarizes that documented IT policies and procedures define an organization's security approach, detail requirements, protect data, provide guidelines for technology usage, improve communication, and allow staff to understand expectations.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    11) HND

    Uploaded by

    Dulanja Omesh
    22 views15 pages
    This document discusses security policies, procedures, standards, and guidelines. It defines each term and explains that policies are formal statements set by management, procedures provide step-by-step instructions, standards mandate actions, and guidelines recommend best practices. The document also outlines different types of security policies an organization may have around user accounts, system access, internet usage, and software. Finally, it summarizes that documented IT policies and procedures define an organization's security approach, detail requirements, protect data, provide guidelines for technology usage, improve communication, and allow staff to understand expectations.

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses security policies, procedures, standards, and guidelines. It defines each term and explains that policies are formal statements set by management, procedures provide step-by-step instructions, standards mandate actions, and guidelines recommend best practices. The document also outlines different types of security policies an organization may have around user accounts, system access, internet usage, and software. Finally, it summarizes that documented IT policies and procedures define an organization's security approach, detail requirements, protect data, provide guidelines for technology usage, improve communication, and allow staff to understand expectations.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    22 views15 pages

    11) HND

    Uploaded by

    Dulanja Omesh
    This document discusses security policies, procedures, standards, and guidelines. It defines each term and explains that policies are formal statements set by management, procedures provide step-by-step instructions, standards mandate actions, and guidelines recommend best practices. The document also outlines different types of security policies an organization may have around user accounts, system access, internet usage, and software. Finally, it summarizes that documented IT policies and procedures define an organization's security approach, detail requirements, protect data, provide guidelines for technology usage, improve communication, and allow staff to understand expectations.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 15

    Unit 5 –Security

    LO4. Manage organisational security.


    11. Security Policies.

    1
    Key Terms

    2
    Policy.

    ▪Policies are formal statements produced and supported


    by senior management.
    ▪They can be organization-wide, issue-specific or system
    specific.
    ▪Organization’s policies should reflect your objectives for
    your information security program.

    3
    Security Policy.
    ▪ A security policy is a written document in an organization
    outlining how to protect the organization from threats,
    including computer security threats, and how to handle
    situations when they do occur.
    ▪ A security policy must identify all of a company's assets as
    well as all the potential threats to those assets.
    ▪ Company employees need to be kept updated on the
    company's security policies.
    ▪ The policies themselves should be updated regularly as
    well.

    4
    Standards.

    ▪Standards are mandatory actions or rules that give


    formal policies support and direction.
    ▪One of the more difficult parts of writing standards for
    an information security program is getting a company-
    wide consensus on what standards need to be in
    place.
    ▪This can be a time-consuming process but is vital to
    the success of your information security program.

    5
    Procedures.
    ▪Procedures are detailed step by step instructions to
    achieve a given goal or mandate.
    ▪They are typically intended for internal departments
    and should adhere to strict change control processes.
    ▪Often act as the “cookbook” for staff to consult to
    accomplish a repeatable process.
    ▪Detailed enough and yet not too difficult that only a
    small group (or a single person) will understand.

    6
    Security Procedures.

    ▪ Security procedures are detailed step-by-step instructions


    on how to implement, enable, or enforce security controls
    as enumerated from your organization’s security policies.
    ▪ Security procedures should cover the multitude of hardware
    and software components supporting your business
    processes as well as any security related business
    processes themselves .
    ▪ Example: Onboarding of a new employee and assignment
    of access privileges.

    7
    Guidelines.

    ▪Guidelines are recommendations to users when specific


    standards do not apply.
    ▪Guidelines are designed to streamline certain processes
    according to what the best practices are.

    8
    Policy, Standards ,Procedures,
    Guidelines

    9
    Different Policies.
    There are a number of policies that can be implemented within an organisation,
    stating the way in which a specific resource should or should not be used.
    ▪ User account and password policy
    This will describe who can administer user accounts, how
    accounts can be enabled and disabled, how often the password
    should be changed and how strong it should be, how to recover
    passwords or accounts, etc.

    10
    Different Policies.

    ▪System access policy


    Describes how the system should be used, and who has
    the authority to use it.
    It should ideally describe scenarios for which the system
    should not be used, so that the users have a clear
    understanding of what is allowed or not allowed.

    11
    Different Policies.
    ▪ Internet and email policy
    Describes what type of websites cannot be accessed, what
    type of information can or cannot be uploaded or downloaded,
    precautions to be taken when sending / reading mail and
    attachments, etc.

    12
    Different Policies.

    ▪Software policy
    Describes what software can be installed, who has the
    right to install it, use of illegal software, attempting to hack
    or crack software, etc.
    ▪Physical access policy
    Any rules with regards to accessing the physical
    resources, what’s allowed and not allowed, times at which
    access is allowed / not allowed, remote access, etc.

    13
    The Benefits of Documented IT
    Policies & Procedures:

    ▪ Define how IT will approach security.


    ▪ Detail security requirements to protect against threats.
    ▪ Protect restricted data.
    ▪ Provide guidelines for acceptable use of technology
    resources.
    ▪ Improve communication and transparency.
    ▪ Set rules and guidelines for decision making.
    ▪ Allow staff to know and understand expectations.

    14
    Lesson Summary

    ▪Policy
    ▪Procedures
    ▪Standards
    ▪Guidelines
    ▪Different Policies
    ▪The Benefits of Documented IT Policies &
    Procedures

    15

    You might also like