|
Security Policy: Topics to Cover
|
səhifə | 2/6 | tarix | 19.12.2023 | ölçüsü | 15,34 Kb. | | #186744 |
| ch14(1)
- needs to address:
- scope and purpose including relation of objectives to business, legal, regulatory requirements
- IT security requirements
- assignment of responsibilities
- risk management approach
- security awareness and training
- general personnel issues and any legal sanctions
- integration of security into systems development
- information classification scheme
- contingency and business continuity planning
- incident detection and handling processes
- how when policy reviewed, and change control to it
Management Support - IT security policy must be supported by senior management
- need IT security officer
- to provide consistent overall supervision
- manage process
- handle incidents
- large organizations needs IT security officers on major projects/teams
- manage process within their areas
Security Risk Assessment - critical component of process
- else may have vulnerabilities or waste money
- ideally examine every asset vs risk
- choose one of possible alternatives based on organization’s resources and risk profile
- baseline
- informal
- formal
- combined
- use “industry best practice”
- easy, cheap, can be replicated
- but gives no special consideration to org
- may give too much or too little security
- implement safeguards against most common threats
- baseline recommendations and checklist documents available from various bodies
- alone only suitable for small organizations
Informal Approach - conduct informal, pragmatic risk analysis on organization’s IT systems
- exploits knowledge and expertise of analyst
- fairly quick and cheap
- does address some org specific issues
- some risks may be incorrectly assessed
- skewed by analysts views, varies over time
- suitable for small to medium sized orgs
Dostları ilə paylaş: |
|
|