CHAPTER 4: INFORMATION SECURITY POLICY by Hafisha Amila

Meer zoals dit

Smart City

door Khaldoun Mohsen

MS302-303 Section 1: Planning Network Infrastructure

door James Herbert

9 Elements of Digital Citizenship

door Zef Shkambi

MS302 - 303 Section 2: Active Directory

door James Herbert

CHAPTER 4: INFORMATION SECURITY POLICY by Hafisha Amila

Guidelines for Effective Policy

Management processes are established to perpetuate the policy within the organization

A senior manager or executive at the appropriate level and the organization’s legal counsel review and formally approves the document

The policy is designed and written

Policy

Bull’s-eye model layers

Applications

System

Network

Policies

essential foundation of an effective information security program

System-Specific Security Policies (SysSPs)

Combination SysSPs

Configuration Rules

Access Control Lists

•Read •Write •Execute •Delete

methods of implementing

•Configuration rules

•Access control lists

Applies to any technology that affects the confidentiality, integrity, or availability of information

Issue-Specific Security Policy (ISSP)

provides detailed, targeted guidance to instruct all members of the organization in the use of a resource

organization’s ISSPs should

Contain a statement on the organization’s position on an issue

Require frequent updates

Address specific technology-based systems

fair and responsible use policies

Enterprise Information Security Policy (EISP)

should not contradict the organizational mission statement

guides the development, implementation, and management requirements of the InfoSec program

Essential foundation of an effective information security program