Scribd Logo
Upload

Welcome to Scribd!

  • 1 views

    security policy

    Uploaded by

    bishtpuneet19

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    security policy

    Uploaded by

    bishtpuneet19
    1 views2 pages

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    1 views2 pages

    security policy

    Uploaded by

    bishtpuneet19

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    You are on page 1of 2

    Guide to Security Policies, Procedures, and Controls

    Understanding the Fundamentals

    Before we dive into the specifics, let's clarify the key terms:

     Security Policies: These are high-level, overarching rules that define an


    organization's approach to information security. They outline the "what" and "why" of
    security.
     Security Procedures: These are step-by-step instructions on how to implement and
    enforce security policies. They provide the "how" of security.
     Security Controls: These are the specific mechanisms and safeguards used to protect
    information assets. They are the "tools" of security.

    Why are They Important?

     Reduce Risks: By implementing robust security measures, organizations can


    minimize the likelihood and impact of security breaches.
     Ensure Compliance: Many industries and regulations require organizations to have
    specific security controls in place.
     Maintain Trust: Strong security practices build trust with customers, partners, and
    employees.
     Protect Valuable Assets: Information is a valuable asset that needs to be protected
    from unauthorized access, use, disclosure, disruption, modification, or destruction.

    Key Security Policies

    1. Acceptable Use Policy (AUP): Defines acceptable and unacceptable use of IT


    resources, such as computers, networks, and software.
    2. Data Security Policy: Outlines how sensitive data is handled, stored, and protected.
    3. Password Policy: Specifies requirements for creating and managing strong
    passwords.
    4. Remote Access Policy: Governs access to company systems and data from remote
    locations.
    5. Incident Response Policy: Details the procedures for responding to and recovering
    from security incidents.

    Common Security Procedures

     User Provisioning and De-provisioning: Processes for adding and removing user
    accounts, ensuring proper access rights.
     Vulnerability Scanning and Patching: Regularly scanning systems for
    vulnerabilities and applying security patches.
     Data Backup and Recovery: Implementing regular backups and testing the recovery
    process.
     Security Awareness Training: Educating employees about security threats and best
    practices.

    Types of Security Controls


     Preventive Controls: Designed to prevent security incidents from occurring in the
    first place (e.g., firewalls, access controls).
     Detective Controls: Aim to detect security incidents that have already occurred (e.g.,
    intrusion detection systems, log monitoring).
     Corrective Controls: Used to mitigate the impact of a security incident after it has
    occurred (e.g., data recovery procedures, incident response teams).

    Example: Implementing a Strong Password Policy

    1. Policy: All passwords must be at least 12 characters long, contain a mix of uppercase
    and lowercase letters, numbers, and symbols.
    2. Procedure: Employees are required to change their passwords every 90 days.
    3. Control: Password complexity and expiration rules are enforced by the organization's
    authentication system.

    You might also like