Security Policies

Security Policies

1. Factors to take into account when designing security policies

   • Physical Security
   • Prevention of misuse
     • Physical methods
     • Logical methods (software)
   • Audit trails for detection
   • Continuous investigation of irregularities
   • System Access (log on procedure, firewalls etc.)
   • Personnel administration
     • Training staff
     • Fitting the employee to the task
     • Ensuring staff are controlled
   • Operational procedures (disaster recovery/dealing with threats from viruses)
   • Staff code of conduct + responsibilities
   • Disciplinary procedures

2. Operational procedures for preventing misuse

   • Screening potential employees
   • Define procedures for downloading from the Internet + personal back up procedures
     • Do not install any software downloaded off the Internet onto your computer
     • Always save downloaded material in a temporary folder, away from the main network
   • Establish security rights for updating web pages
   • Establish a disaster recovery programme
   • Set up audit trails to detect misuse

3. Prevention of accidental misuse

   • Back up and recovery procedures
   • Standard back ups to floppy disc
   • RAID systems
   • Grandfather, father, son system
   • Backing up program files

4. Prevention of deliberate crimes or misuse

   • Establish firewalls/proxy servers
   • Methods of securing integrity of tansmitted data
     • Encryption methods including private and public keys
   • Methods to define security status and access rights for users
     • Hierarchy of passwords
     • Allocation of access rights based on job seniority
   • Methods for physical protection of hardware and software
     • Restricted access to computer rooms
     • Keyboard locks
     • Lock away computers at end of day
     • Firewalls to protect networks from unauthorised access
     • Locks on computers which make use of biometric methods

5. Potential threats and consequences for data misuse

   • Threats
     • Terrorism
     • Natural disasters
     • Sabotage
     • Fire
     • Theft
   • Consequences
     • Loss of business and income
     • Loss of reputation
     • Legal action