Understanding Security Policies

A security policy for an organization can be defined as a set of rules, formed to secure a company's intellectual property. A security policy describes data flow limitations and restrictions to access by external sources, such as malicious programs, code files, and data. A security policy is used by the company's staff, IT users, and administrators, and so on. A security policy must be enforced on an organization's network so it helps them to protect the network from potential attack and threats.

The following should be considered before creating a security policy:

• A security policy can be formed to balance access and security, and to minimize risk
• A security policy created should not replace the thoughts of the user
• When a potential threat is identified, a security policy must be created in such a way that it can be changed

Also, the policies created should define the following:

• Aims of the policy
• Actions by the policy
• The device on which the policy is configured
• Consequences if there is a failure in the policy

Upon completing this chapter, you will:

• Understand the purpose of a security policy
• Understand the components of a security policy
• Understand risk and the purpose of implementing a risk-analysis mechanism
• Understand vulnerability and how it will affect the network and systems
• Understand threats and their different consequences
• Identify different asset levels of assets
• Understand the importance of countermeasures
• Identify the different types of security zones
• Understand the security mechanisms implemented on the data, management, and control planes
• Understand the different regulatory compliance mechanisms