SHARE

Enforcing Your Bullet-Proof Security Policy

Communicating to Users The site security policy should include a formal process, which communicates the site security policy to all users. In addition, an educational campaign will make users aware of how computer and network systems are to be used, and how to protect themselves from unauthorized users. All users will need to know what’s […]

Written By

Elizabeth Ferrarini

Oct 9, 2001

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

Communicating to Users
The site security policy should include a formal process, which communicates the site security policy to all users. In addition, an educational campaign will make users aware of how computer and network systems are to be used, and how to protect themselves from unauthorized users.

All users will need to know what’s considered the proper use of their account or workstation. This communication can most easily be done at the time a user receives their account, by giving them a policy statement. Proper use policies typically should dictate things, such as the following: whether or not the account or workstation may be used for personal activities (such as checkbook balancing or letter writing), whether profit-making activities are allowed, or whether game playing is permitted, etc.

Users should be told how to detect unauthorized access to their account.

If the system prints the last login time when a user logs in, he or she should be told to check that time and note whether or not it agrees with the last time he or she actually logged in.

Ideally, the security policy should strike a balance between protection and productivity.

Responding to Violations
Upon realizing a site security violation, an organization will select a number of responses – both good and sub-optimal. To this end, you should plan responses for different scenarios without the burden of an actual event.

Not only do you need to define actions based on the type of violation, you’ll also need to have a clearly defined series of actions for users who violate your computer security policy.

When a policy violation has been detected, you should immediately invoke the pre-defined define course of action. Next, you’ll need to have an investigation performed to determine how and why the violation occurred, and what is the appropriate corrective action. The type and severity of action taken will vary depending on the type of violation that occurred.

Discovering Violations: Choose Your Strategy
Once you’ve determined that the violation it’s being perpetrated by someone outside the organization, you’ll have to decide what aspect of your security plan should be put in motion. So, you’ll need to make sure you site security plan can answer the following questions:

What outside agencies should be contacted, and who should contact them?
Who may talk to the press?
When do you contact law enforcement and investigative agencies?
If a connection is made from a remote site, is the system manager authorized to contact that site?
What are our responsibilities to our neighbors and other Internet sites?

Whenever a site suffers an incident compromising computer security, two opposing pressures may influence the way the organization reacts.

Read Part 1: Establish A Bullet-Proof Security Policy