Site Security Assessment
Security Policy Development
Picking the right road is easy when you know your objective. A Security Policy,
tailored to the specific needs of your enterprise, identifies the objectives for your
information security efforts. Clear, sensible objectives save you money
and effort wasted plugging the wrong holes. A clear security policy
guides your employees in protecting your computing systems and other
information resources.
Security Policy Development
is one part of Minnesota OnLine's comprehensive package of enterprise
security services. The companion Information Security Assessment
reviews your enterprise's existing security policy against your existing
security equipment, plans and procedures. The companion Penetration
Analysis tests your enterprise's existing security measures against
their intended behavior. These three services are available individually
or as a package, giving you the assurances you need that your
information security program meets the needs of today's ever-changing
enterprise networks.
What the Security Policy Does
The Security Policy establishes your security objectives and how your enterprise
intends to achieve them. This is achieved through the following:
The assessment begins as follows:
Identify your enterprise's critical information resources and how they are used.
Define the framework for managing and protecting those resources.
Establish mechanisms for adapting to changing internal and external requirements.
Guide future decisions by establishing criteria for selection and implementation.
The Security Policy identifies crucial facts such as
1) how data and computing
resources should be used;
2) what data you must protect;
3) who and what you are protecting
it from; and
4) how you are going to protect it.
What the Security Policy Contains
The Security Policy contains a series of specific sections that address the
critical elements of an effective information security program:
Security Objectives and Enterprise Policy Statement
Information Labeling and Access Control Requirements
User Authentication and Authorization Requirements
Internet and Electronic Mail Acceptable Use Guidelines
System Management and Administration Guidelines
User Security Awareness Training Guidelines
Monitoring, Auditing and Enforcement Guidelines
| 