Security Policies

Module 6 — Lesson 8: Security Policies

Security policies provide a formal framework for protecting an
organization’s information, systems, devices, users and services.
They explain what is expected, what is permitted, who is responsible,
and how security requirements should be followed.

Technology alone cannot create a strong security environment. An
organization also needs clear rules, responsibilities, procedures and
accountability. Security policies help turn security principles into
consistent organizational practices.

1. What Is a Security Policy?

A security policy is a formal statement describing an organization’s
security requirements, expectations and responsibilities.

A policy may apply to:

• Employees
• Students
• Contractors
• Administrators
• Managers
• Third-party service providers
• Information systems
• Computers and mobile devices

2. Why Security Policies Matter

Security policies create a common understanding of how an organization
expects people and systems to handle security.

They can help an organization:

• Reduce security risks.
• Define responsibilities.
• Protect confidential information.
• Establish acceptable behavior.
• Support compliance requirements.
• Improve incident response.
• Standardize security practices.
• Provide management direction.

3. Policy, Standard, Procedure and Guideline

These terms are related but serve different purposes.

• Policy: States the organization’s high-level
  requirements and expectations.
• Standard: Defines mandatory technical or
  operational requirements.
• Procedure: Describes the specific steps used to
  perform a task.
• Guideline: Provides recommended advice or
  flexible direction.

4. Characteristics of a Good Security Policy

A good policy should be:

• Clear
• Understandable
• Relevant
• Enforceable
• Practical
• Consistent
• Measurable where appropriate
• Reviewed regularly
• Approved by appropriate management

5. Security Policy Structure

A security policy can contain several common sections.

1. Purpose
2. Scope
3. Definitions
4. Roles and responsibilities
5. Policy requirements
6. Exceptions
7. Enforcement
8. Review schedule
9. Approval information

6. Purpose

The purpose section explains why the policy exists.

For example, a password policy may state that its purpose is to reduce
the risk of unauthorized access to organizational accounts and
information.

7. Scope

The scope explains who and what the policy applies to.

A policy might apply to employees, contractors, students,
administrators, company-owned computers, approved personal devices,
cloud services and other organizational systems.

8. Roles and Responsibilities

A policy should make responsibilities clear.

For example:

• Management: Approves and supports security policies.
• Security Team: Develops and monitors security controls.
• IT Team: Implements technical requirements.
• Users: Follow security requirements and report incidents.
• Auditors: Review compliance where applicable.

9. Acceptable Use Policy

An Acceptable Use Policy, or AUP, describes how organizational
technology may be used.

It may address:

• Internet usage
• Email
• Social media
• Company computers
• Mobile devices
• Cloud services
• Software installation
• Personal use
• Illegal or prohibited activities

10. Password and Authentication Policy

A password policy establishes requirements for protecting accounts.

It may define:

• Authentication requirements
• Password construction
• Multi-factor authentication
• Password manager usage
• Account lockout controls
• Credential protection
• Privileged account requirements

Modern security programs should avoid relying on passwords alone where
stronger authentication methods are available.

11. Access Control Policy

An access control policy explains how users receive and maintain access
to systems and information.

It may address:

• Account creation
• Role assignment
• Least privilege
• Privileged accounts
• Access reviews
• Account termination
• Remote access
• Third-party access

12. Data Protection Policy

A data protection policy establishes expectations for handling
organizational and sensitive information.

It can classify information according to sensitivity and define
appropriate controls.

Common classifications include:

• Public
• Internal
• Confidential
• Highly confidential or restricted

13. Data Handling Requirements

A policy may explain how sensitive information should be:

• Collected
• Stored
• Accessed
• Transmitted
• Shared
• Backed up
• Archived
• Destroyed

14. Endpoint Security Policy

An endpoint security policy defines the minimum security requirements
for computers, laptops, mobile devices and other endpoints.

Requirements may include:

• Supported operating systems
• Security updates
• Anti-malware protection
• Host firewalls
• Device encryption
• Screen locking
• Least privilege
• Application control
• Security monitoring

15. Remote Access Policy

A remote access policy establishes requirements for accessing
organizational resources from outside controlled locations.

It may require:

• Approved remote-access technologies
• Multi-factor authentication
• Encrypted communication
• Approved devices
• Security monitoring
• Session controls
• Restricted administrative access

16. Bring Your Own Device Policy

A BYOD policy explains how personal devices may interact with
organizational systems.

It should balance productivity and convenience with privacy and
security requirements.

It may address:

• Supported devices
• Security software
• Encryption
• Authentication
• Organizational data separation
• Lost-device reporting
• Remote management
• Device retirement

17. Incident Response Policy

An incident response policy explains how the organization should
respond when a security incident occurs.

It should define responsibilities and establish a framework for
detection, reporting, containment, investigation, recovery and
lessons learned.

18. Security Incident Reporting

Users should know how to report suspected security incidents.

Examples include:

• Lost company device
• Suspected phishing
• Unexpected password reset
• Suspicious system behavior
• Unauthorized account activity
• Possible data exposure
• Malware notification

19. Backup Policy

A backup policy establishes requirements for protecting organizational
data against loss or corruption.

It may specify:

• What data must be backed up
• Backup frequency
• Retention periods
• Storage locations
• Encryption
• Access controls
• Restore testing
• Responsibilities

20. Security Awareness Policy

Employees and users are an important part of an organization’s
defensive security program.

A security awareness policy can establish requirements for training
users about phishing, passwords, social engineering, data handling,
device security and incident reporting.

21. Third-Party Security Policy

Organizations often share information or systems with vendors,
consultants and service providers.

A third-party security policy can establish minimum security
requirements before external parties receive access.

Considerations include:

• Vendor security assessment
• Access limitations
• Contractual requirements
• Confidentiality
• Data protection
• Incident reporting
• Access termination

22. Physical Security Policy

Cybersecurity also depends on physical protection.

A physical security policy can cover computer rooms, server rooms,
office access, visitor management, equipment protection and secure
disposal.

23. Mobile Device Security Policy

Mobile device policies can establish requirements for smartphones,
tablets and other portable devices.

Controls may include:

• Screen locks
• Encryption
• Approved applications
• Operating system updates
• Remote wipe
• Secure wireless use
• Lost-device reporting

24. Cloud Security Policy

A cloud security policy defines expectations for using cloud services.

It may address:

• Approved cloud platforms
• Account management
• Multi-factor authentication
• Data classification
• Access permissions
• Logging
• Backup
• Third-party integrations

25. Security Policy Enforcement

A policy is useful only when people understand it and the organization
has mechanisms for enforcing it.

Enforcement should be fair, consistent and appropriate to the
organization’s legal and operational requirements.

26. Policy Exceptions

There may be legitimate situations where a standard security
requirement cannot immediately be followed.

Exceptions should not simply be ignored. They should normally be
documented, reviewed, approved by an authorized person and assigned
an appropriate expiration or review date.

27. Policy Review

Security policies should be reviewed periodically because technology,
threats, business processes and regulatory requirements change.

Policies should also be reviewed after major incidents, significant
system changes or changes to organizational responsibilities.

28. Policy Lifecycle

A simple policy lifecycle is:

1. Identify the security need.
2. Research requirements.
3. Draft the policy.
4. Review with stakeholders.
5. Obtain approval.
6. Communicate the policy.
7. Implement supporting controls.
8. Monitor compliance.
9. Review and update.

29. Security Policy and Risk Management

Security policies should be connected to actual organizational risks.
A policy should not exist simply because it sounds professional.

For example, if an organization has sensitive customer information,
its policies should address access control, data handling, encryption,
backup, incident reporting and secure disposal.

30. Security Policy and Least Privilege

Policies can formally establish the principle of least privilege.
Users should receive only the access required to perform their
authorized responsibilities.

This principle should also apply to administrators, applications,
service accounts and third-party connections.

31. Security Policy and Logging

Some security policies define requirements for logging important
security events.

Examples include:

• Authentication events
• Administrative activity
• Security alerts
• Access to sensitive resources
• Configuration changes

Logging requirements should consider privacy, storage capacity,
retention and access to security records.

32. Security Policy Awareness

Publishing a policy is not enough. Users should be informed about
policies relevant to their responsibilities.

Organizations can use onboarding, periodic training, reminders and
security awareness programs to reinforce important requirements.

33. Example Security Policy

The following is a simplified educational example of an endpoint
security policy:

Endpoint Security Policy

1. All organizational computers must use supported operating systems.

2. Security updates must be installed according to the organization's
   approved patch-management process.

3. Endpoint protection must remain enabled unless an authorized
   administrator approves an exception.

4. Users must not install unauthorized software.

5. Administrative privileges must be restricted to authorized users.

6. Sensitive laptops and portable devices must use appropriate encryption.

7. Suspected security incidents must be reported promptly.

8. Lost or stolen organizational devices must be reported immediately.

9. Security controls must not be intentionally disabled.

10. The policy must be reviewed periodically.

34. Practical Policy Writing Exercise

Imagine that you are the security officer for a small training
institute with computers, Wi-Fi, student records, staff accounts and
online learning systems.

Create a short policy containing:

1. Purpose
2. Scope
3. User responsibilities
4. Password requirements
5. Computer security requirements
6. Internet usage rules
7. Data protection requirements
8. Incident reporting
9. Policy enforcement
10. Review schedule

35. Practical Security Policy Review

Review an existing organization’s security policy, if you are
authorized to access it.

Check whether it clearly answers:

• Who is responsible for security?
• Who is allowed to access systems?
• How are accounts managed?
• How should incidents be reported?
• How should sensitive information be handled?
• How are devices protected?
• How are backups managed?
• How are third parties controlled?
• How are exceptions approved?
• When is the policy reviewed?

36. Common Security Policy Mistakes

• Writing policies that are too complicated.
• Using vague requirements.
• Creating policies without assigning responsibility.
• Failing to communicate policies.
• Never reviewing old policies.
• Creating rules that cannot realistically be enforced.
• Ignoring exceptions.
• Failing to connect policies to actual risks.
• Not training users.
• Having policies but no supporting technical controls.

37. Best Practices

• Keep policies clear and understandable.
• Align policies with organizational risks.
• Assign clear ownership.
• Obtain appropriate management approval.
• Communicate policies to users.
• Train users on important requirements.
• Use technical controls to support policy enforcement.
• Document approved exceptions.
• Review policies regularly.
• Update policies when technology or risks change.

38. Practical Lab

Create a basic cybersecurity policy for a fictional organization
called Dwallnet Training Institute.

Your policy should include:

1. Acceptable use.
2. Password and authentication requirements.
3. Endpoint security.
4. Access control.
5. Data protection.
6. Backup requirements.
7. Incident reporting.
8. Security awareness training.
9. Remote access.
10. Policy review and enforcement.

Keep the policy concise, realistic and easy for ordinary users to
understand.

39. Knowledge Check

1. What is a security policy?
2. Why are security policies important?
3. What is the difference between a policy and a procedure?
4. What is an Acceptable Use Policy?
5. What should an access control policy define?
6. Why should security policies be reviewed regularly?
7. What is a policy exception?
8. Why is security awareness important?
9. What is the purpose of an incident response policy?
10. Why should security policies be connected to risk management?

40. Key Terms

• Security Policy:
  A formal statement of security requirements and expectations.
• Standard:
  A mandatory requirement defining how something should be implemented.
• Procedure:
  A documented sequence of steps for performing a task.
• Guideline:
  Recommended advice that may allow flexibility.
• AUP:
  Acceptable Use Policy.
• Scope:
  The people, systems or activities to which a policy applies.
• Exception:
  An approved deviation from a security requirement.
• Compliance:
  Following applicable policies, requirements or controls.
• Least Privilege:
  Giving users or systems only the access they need.
• Policy Lifecycle:
  The process of creating, approving, communicating, enforcing and
  reviewing a policy.

41. Lesson Summary

Security policies provide the organizational foundation for
cybersecurity. They establish expectations, responsibilities,
acceptable behavior and security requirements.

Effective policies should be clear, practical, enforceable and aligned
with organizational risks. They should be communicated to users,
supported by appropriate technical controls and reviewed regularly.

A strong cybersecurity program combines policies with technology,
people, training, monitoring and incident-response capabilities.