What are Security Policies? Organizational Security Policies

Introduction

This article introduces the concept of security policies at the organizational level and explains how they differ from public policy. The focus is on preparing learners for developing a security policy for an organization.

Key Points:

1. Definition of a Security Policy:

• A policy articulates goals and objectives that guide decision-making and behavior in an organization.

• Policies typically take the form of documents outlining desired goals, rules, and procedures to achieve those goals.

2. Components of a Security Policy:

• Principles: Broad goals related to security.

• Policy Statements: What is permitted, encouraged, or banned.

• Rules and Procedures: Specific steps and controls to implement the policy.

• Guidelines: Non-mandatory parameters that offer flexibility.

• Definitions: Clarify the meaning of terms to ensure understanding.

• Compliance Monitoring and Enforcement: Methods to ensure compliance with the policy and actions to be taken if non-compliance occurs.

3. Organizational Policy vs. Public Policy:

• Organizational policies: Govern specific organizations, are flexible, and tailored to the organization’s goals.

• Public policies: Govern society as a whole, created by governments, and have broader implications.

• Example: An organization can block sports websites for its employees, but if a government does this, it could be seen as censorship.

4. Automated Policies:

• Policies can also be programmed into machines (e.g., routers and firewalls) to control network traffic based on predefined rules.

5. Government Organizations:

• Government agencies, though part of the public sector, create organizational policies to manage their own ICT infrastructure, separate from broader public policy.

6. Blurring of Lines:

• Sometimes, government organizational policies may impact the public, blurring the line between organizational and public policy (e.g., the Defense Department keeping threat signatures secret).

Conclusion:

The lesson highlights the difference between organizational and public policies, discusses key components of a security policy, and emphasizes the importance of clarity in defining terms and procedures. It also touches on automated security policies implemented in machines, which extend organizational policies.