Effective Organizational Security Policy

Introduction

Information security is continually gaining prominence within the corporate world because of the value that organizations are currently realizing from information as an asset. As valuable, as this is the corporate world is going to great lengths to understand what requirements need to be setup to ensure an effective security policy (Lasa, 2010). This paper is focusing on the desirable security practices and policies for the organization aimed at understanding the threats and minimizing or all together eliminating them.

Computer system security remains very important in order to protect the integrity of stored information. The file system has the mechanism needed for storing and accessing data and programs within the computer system.

Resident information on a file system is vital and needs to be monitored in order to detect unauthorized and unexpected changes thereby providing protection for the system against intrusion. (Ojowi, 2010, p.1)

As computer systems continue in advancement, security has continued to be a big challenge as far as this progression is concerned. More security breaches are becoming harder to detect due to the nature of the activity. The intention is to advance the clandestine activities within the system unnoticed to levels where irreversible damage can be registered. Therefore, intrusions remain one of the most hazardous yet subtle activities on any computer setup. Because of such threats, concerted research has been going for some time now and continues to address the emerging threats and work on ways to eliminate them. However, these efforts continue to be less effective mainly because the initiators of such clandestine activities continue to focus on every opportunity available to exploit known and unknown system weak points.

One of the credible ways available to identify system intrusion involves a study of the file system status at various checkpoints. Unexplained variations in the status of these files will most likely indicate a breach of the system and as such should catch the eye of the system administrator. Many operating systems are incorporating tools in their software package to address these threats.

An effective organizational security policy

Having assessed the importance of information to their organization, the management must come up with a suitable information security policy to govern their information. Some of the likely issues within such as policy would include:

1. The objectives of information security to the organization
2. The scope of information security procedures within the organization
3. The management’s statement ascribing to the goals and principles of the information security policy
4. An explanation of the basic standards, requirements, objectives and procedures of the policy to the organization.
5. Roles and the responsibilities related to information security
6. Supporting documentation references
7. Internet use by the organization and the related threats
8. Guidelines and standards followed as well as the authority responsible for connections (external to the internet).

The information security policy for an organization is akin to a blueprint of standards and procedures as well as scope of information security within an organization (AKS-Labs, 2010). This policy enumerates the various issues such as the security mechanisms like attack detection, avoidance and prevention which are defined within the attack framework. The policy describes and prioritizes the various attack risks typical to the organization while elaborating suitable mitigation procedures in the event of such attacks. This policy provides a basis of a clear assessment of whether an attack has occurred or not. It is vital for stringent procedures to be setup to detect the conspicuous and hidden threats such as intrusions. Forensic methods and tools are available to detect such hidden attacks (Kruse & Heiser, 2001).

While prioritizing these attack risks based on their effect to the organization’s processing, the policy will provide formal procedures of recovery based on the security mechanism. Methods of attack prevention are defined within the policy as well as those for avoidance and detection.

Features of the security policy

The following features are vital in defining an effective security policy within an organization especially in addressing external intrusion and unauthorized access:

1. For unauthorized access using a combination of technology, procedures, policies and user awareness such as installation of a properly configured firewall for the internet connection, using anti virus software, spyware and attachment content scanners. Regular update to these tools is vital to counter the latest intrusion threats.
2. For wireless technology, it is vital to protect data and information using appropriate security. Wireless equipment settings maybe turned off by default. It becomes necessary that such settings are checked and adjusted appropriately. Using a virtual private network (VPN) to enhance privacy is a suitable consideration where the organization employs mobile computing.

Nonrepudiation results from breeches over an internet connection. A well-defined authentication process must be defined within the information security policy to minimize such threats. Other common threats on the network would include integrity that relates to the correctness of the data being transmitted. Availability is also another consideration that may be directly related to denial of service threat. These threats are more effectively addressed within the security policy.

Attack framework

Testing the effectiveness of any procedures within the security policy may involve simulated attacks to the system in place and a thorough assessment of detection and prevention procedures. This will constitute the attack framework. The use of tools such as tripwire and honey pots are some good examples of initiation an attack framework. These procedures can be studied to locate the vulnerable points within the security system as detection and thereby provide ways of avoiding such attacks (Fadia, 2007).

Conclusion

Security policy is a very important consideration for any organization. This must be drawn to cover all the processes and staff training as well as management good will must accompany it in order to achieve the necessary success.

References

AKS-Labs. (2010). Effective security policy. Web.

Fadia, A. (2007). Network intrusion: An ethical hacking guide to intrusion detection. Cambridge, MA: Course Technology.

Kruse, W.G., & Heiser, J.G. (2001).Computer forensics: Incident response essentials Reading, MA: Addison Wesley.

Ojowi, J.G. (2001). Developing an effective security policy. Cambridge, MA: Course Technology.