Information Security Policy Development

• Information security programs rely on policy development for success.
• Policy acts as the foundation for any effective security program.
• Information security training is not possible without written policies.
• Program success depends on the generated policy, and management's attitude.
• Primary responsibility to set policy, compliance with laws, regulations, and confidentiality.
• Policies should never contradict the law.
• Policies should be defensible if challenged in court.
• Policies must be supported and properly managed.
• Enron's business practices and shredding working papers are examples of failures.
• A quality information security program starts and ends with policy.
• Information security policies are the least expensive yet difficult to implement.
• Policy costs include the time and effort spent to create, approve, communicate, and integrate.
• Hiring a consultant is minimal compared to technical controls.
• Management must ensure responsibility is shared for proper use of information systems.
• End users should be involved in policy formation.
• Policies must contribute to organizational success.

Bull's Eye Model

• A proven approach for prioritizing complex changes.
• Issues are addressed from general specifics.
• Focuses on approaching issues with systematic solutions instead of individual solutions.
• The model layers from outer to inner are policies, networks, systems, and applications.
• Policies are the outer layer which guides user behavior.
• Networks connect the org to outside networks; traditionally the focus of security efforts.
• Systems are computers used for servers, desktops, process control, and manufacturing.
• Applications range from office automation to high-end custom applications.

Policy, Standards, and Practices

• Policy expresses an organization's information security philosophy.
• Communities use policy to express views, forming the basis for planning and management.
• Policies set rules for acceptable behavior within an organization.
• Policies should not specify equipment or software operations.
• Policies must state penalties for unacceptable behavior and define the appeals process
• Executing policy requires implementing standards to define inappropriate actions.
• Standard dictates what must be done to comply with policy.
• Technical controls and procedures can block access to inappropriate content.

Policy and Implementation

• Policies state "Why do I need to do this?".
• Policies can state "Employees must use strong passwords".
• Standard states: "What is required?".
• Standard guidelines specify compliance with the policy.
• An example standard is passwords being at least 10 characters, and incorporate other elements.
• Practices include "What is recommended guidance?".
• US-CERT can be a example of "Practices".
• Procedures state: "How do I do it?".
• Changing a password on the system.

Types of InfoSec Policies

• Based on NIST, the three types of security policies are Enterprise, Issue-Specific, and System-Specific.
• The typical procedure is to create the enterprise security policy first and then develop issue and systems policies.

Enterprise Information Security Policy (EISP)

• Sets the direction, scope, and tone for security efforts.
• Assigns responsibilities in the various IT related areas
• Guides the development, requirements, implementation, and management.
• Should directly support the mission and vision statements.

Integrating an Organization's Mission

• The EISP should state the importance of InfoSec to organizational objectives.
• InfoSec strategic planning derives from IT strategic planning.
• Policy may be confusing if it does not reflect these relationships.

Elements of EISP

• Provides an overview of the corporate philosophy on security.
• Includes information on the structure of the InfoSec organization.
• Specifies responsibilities for security shared by all org members.
• Delineates security responsibilities for security unique to each role.

Components of Good EISP

• Statement of Purpose.
• IT Security Elements.
• Need for IT Security.
• IT security responsibilities and roles.
• References to other standards and guidelines.

Issue-Specific Security Policy (ISSP)

• ISSP provides a common understanding of how employees can and can't use a technology.
• Should not be presented as a foundation for administrative legal action.
• Protects employees and the organization.
• Articulates expectations for using technology-based systems.
• Identifies control processes and authorities.
• Protects the organization from liability due to employee misuse.

ISSP Topics

• Covers internet use, email, phone, and office equipment.
• Incident response
• Disaster/business continuity planning.
• Hacking and security control testing prohibitions.
• Home use of company-owned systems.
• Personal equipment on company networks.
• System configuration requirements.

ISSP Components

• Statement of purpose.
• Authorized uses.
• Prohibited uses.
• System management.
• Policy violations.
• Policy review/modification.
• Limitations of liability.

ISSP Implementation Approaches

• Create documents tailored to specific issues.
• Create a single document covering all issues.
• Create a modular document unifying policy creation while addressing specific details.

Implementation Approaches Advantages

• Individual Policy: Clear assignment, with superior expertise for technology-specific actions.
• Comprehensive Policy: Well-controlled, assures complete topic coverage and procedures.
• Modular Policy: Good balance with well-controlled procedures and responsible departments

Implementation Approaches Disadvantages

• Individual: Can be a scattershot that fails to properly cover all issues.
• Comprehensive: Poor policy dissemination, enforcement, review/may skip vulnerabilities.
• Modular: Potentially difficult to manage, and more expensive.

System-Specific Security Policy (SysSPS)

• SysSPs give guidance for configuring systems, tech, and apps.
• Includes intrusion detection, firewall, and workstation configurations.
• Often technical, and also managerial in nature.
• Separated into Technical Specifications and Managerial Guidance.
• Guides the way to enforce high level policy.

Guidelines for Effective Policy

• Developed using industry-accepted practices.
• Distributed using methods that are appropriate
• Reviewed by all employees.
• Understood by everyone.
• Formally agreed to by either act statements.
• Enforced uniformly.

Developing Information Security Policy

• Investigation Phase: Outline scope, developing a detailed plan of the investigation's boundaries and focus.
• Analysis Phase: Community Participation, engage affected communities, gathering collaborative feedback.
• Design Phase: Articulate Goals, clearly define, and communicate the investigation's objectives.
• Management support: Securing support from IT, ensuring the authority.
• Investigation Phase: Conduct risk assessment, and identify evaluate risks.
• Analysis Phase: Perform IT audit, and review verifiable security controls.
• Design Phase: Collect various policies and documents known as reference materials.
• Implementation/Development Phase: Distribute, and finalize the policy.
• Provide an acknowledgement to users.
• Display a warning and a document.
• Maintenance Phase: Monitor, improve, and identify necessary changes.
• Involve Policy Team to find any resource policies.

Information Security Policy Distribution

• Hand policy to employees.
• Post policy on a public bulletin board.
• Email
• Intranet
• Document management system.

Policy Comprehension

• Should be written at a reasonable reading language.
• Should be written with minimal technical jargon.
• Understanding of use policies.

Policy Compliance

• Policies must be agreed to by act or affirmation.
• Corporations incorporate policy confirmation statements into employment contracts.

Policy Enforcement

• Enforcement must be uniform and impartial, withstand external scrutiny.
• High standards of due care for claims made by terminated employees.

Automated Tools

• VigilEnt Policy Center is a centralized implementation center.
• Policies should have easy approval and minimal need to distribute paper copies.
• Can easily be accessed by the administration site.

Policy Management

• Policy admin should solicits business from the IS communities.
• Must conduct reviews periodically.
• Must follow procedures and practices.
• Policy and revision dates should always be clearly posted.
• Policies should be a countermeasure.
• Should improve employee productivity.
• Communicate penalties for noncompliance.