Developing a Company Network Security Policy

As we all know people are where we see the biggest problems in security breaches and problems on any computer or network system. People need to understand what they are allowed and not allowed to do, this is where policies, procedures, and training come in to play.

Organizations should develop a security policy for the wireless LAN infrastructure prior to the implementation stage. In order to have a strong security policy,

“Security needs to be addressed as a continued lifecycle to be effective. Daily, there are new attack signatures being developed, viruses and worms being written, natural disasters occurring, changes in the organization workplace taking place and new technologies evolving, these all effect the security posture in the organization” (King, 2002). This being said, it is important to evaluate firewall and router rule sets more frequently. The possible threats against this policy include improperly configured network infrastructure which leads to a domino effect that could start with malicious programming which could end in data loss. Many of these threats may be unintentional as some users may not be aware of the risks and how their processes and procedures open the door for such attacks. For this reason alone, a more frequent evaluation is needed. This vulnerability could lead to data loss and the exposure of trade secrets, client lists and product design. The exposure of such information for most companies could mean a financial collapse as it no longer has the competitive edge that makes it the industry leader. While the likelihood of this threat is very high, “security risks to the network exist if users do not follow the security policy. Security weaknesses emerge when there is no clear cut or written security policy document. A security policy meets these goals:

This policy establishes the guidelines that the organization follows. This would include an acceptable use policy, an authentication policy, and an incident response policy (“The IT Security Policy Guide”, n.d., pg. 6). This policy will reflect the entire organizations security posture, not just the IT department ideas. A strong policy will help employees understand what is expected of them, and explain to customers how their information is protected.

The framework of security policy is defined to construct a structure by the help of which policy gaps can be identified in an easy manner. A system specific policy would assist to ensure that all employees and management comply with the policies. This is also used to maintain the confidentiality for user authentication would assist in the confidentiality aspect of security, maintain integrity (There are several limiting rules or constraints which are distinct in the relational data model and whose work is to maintain the data’s accuracy and maintain its integrity.), availability and authenticity of the system. Access controls are a collection of mechanisms that work together to create security architecture to protect the assets of an information system. One of the goals of access control is personal accountability, which is the mechanism that proves someone performed a computer activity at a specific point in time. So, the framework acts as the guideline

This policy provides a framework for the management of information security throughout Cañar Networking organization. It applies to:

Many companies have several locations that are statewide as well as international. The threat to the company’s security policy is that much greater because of the company’s expansion; this has placed the company’s information at a higher level for security breaches. The company needs to stay up-to date with the latest technology to make sure the company information can be accessed to all of their locations efficiently. Organizations that have global operations have a harder time effectively securing their information. The Internet is one of the common ways that an international company uses to conduct business; because the company can use their website to post information.

A sound information security policy begins with an understanding of what is the current climate, which can consist of policies, regulations, and laws. It is imperative to understand what legislation your line of business must comply with as well any applicable governance requirements. Beginning with defining what is a policy, a guideline and a standard: a policy provides specific requirements or rules to abide by, which can be either at the governmental level, meaning a statute and/or organization-specific directive; also known as administrative law. According to the SANS Institute (n/d), a leading cooperative research and education organization, a standard can be an amalgam of requirements that is applicable to the user body; and a guideline can be considered akin to a recommendation for a best practice (SANS Institute, n/d). Current government policies can be issued by federal, state, local and/or tribal

Any enterprise has to pay special attention to computer security. Computer security is a field that is concerned with the control of risks related to computer use. A primary focus should be on the external threats to the computing environment. In enterprise with branches cross country, it is important to allow information from "trusted" external sources, and disallow intrusion from anonymous or non-trusted sources. In a secure system, the authorized users of that system are still

For example a clerk will only be able to access a limited amount of information, such as inventory at each store. The limitations will be different for an accountant or the mangers. All information will be protected with several different layers of security. The first layers will be simple hardware protection for access to the network; from there the security will increase with password protection and restrictions to users. (Merkow & Breithaupt 2006)

All customer information will be stored in the system and accessible to the clerks as read only. Everything is to be password protected and only managers will have the ability to alter said information.

For the healthcare industry it is important to have an Information Security Policy Framework within the organization to protect information that is accessed across the network by staff personnel and patients. In accordance with ISO/IEC 27799:2008, we begin to define the guidelines to support the interpretation and implementation of healthcare information protection. ISO/IEC 27799:2008 references the basic controls and guidelines of ISO/IEC27002:2005 will provide the minimum protection necessary to meet organizational needs. Healthcare organizations that

All employees, business associates and vendors will be made aware of the security policies set forth in this document that must be carried out until further notified. The security standards set forth to carry out this plan have been trialed and

In shaping a new security policies, it is essential to have a full understanding of all aspects of the internal network and services to be protected from both internal and outside threats. An article by Solms & Solms (2004) outlines several criteria in developing information security. First, a governing body must be formed to ensure all sensitive data is secured and provide due

Some of the items that will need to be made aware of and shared with executives, employee and the stakeholders of the organization is the managing and protection of Access Control and attack monitoring system, each and every member of the company will need to understand and abide by the policies that govern access control in the workplace, allowing other employees to enter a facility without each employee scanning their badges will be a breach of security. The awareness of securing network architecture and network communications components, raise awareness on security governance concepts and policies and risk and personal management. The support of the entire organization in the changes and improvement will results in an effective strategic