Security Policies

A Security Policy is Overall a general

statement stated by the senior
managment in an Organization.
A well designed Policy illustrates..
a) what is being Secured?
b) who is expected to comply with this
policy?
c) where is the vulnerability, threat or risk?

03/25/17 1
 Types of Policies
Regulatory: This policy ensures that the Organization
should follow some specific industry regulations.
Example: American Financial Institutions should follow
the Federal Reserve regulations.
Advisory: This policy advices to its employees for
which types of behaviors, and activities should have,&
should nt have.
Example: how to handle the process confidential
Information, financial transactions.
Informative: It is not an enforceable policy, it teaches
Individuals about a specific issues relevant to the
Company,and its goals&mission.

03/25/17 2
 Role of Security Awareness
training.
To days world Security Awareness training
(SAT)is a top priority for all organizations of all
sizes.
Many companies invest in cyber security
education programs for its employees to learn
how to protect their computer and personal
information from the hackers.
By adopting a Security Awareness training
program a company greatly increases its
security related risk posture.

03/25/17 3
 Steps that can be taken to help
ensure compliance with policies
Meet with the divisional leaders to ensure the
policies and procedures are feasible.
Determine the best format of policies for your
audience.
Make policies, and procedures easily accessible
to all employees.
Set deadline for each policy & procedure.
Determine the best way to measure the
understanding your employees have of policies
and procedures .
03/25/17 4
 Human resources security
This policy provides a guidelines for its
employees to aware of policies and duties.
The policy ensure that employee-employer
relationships and behavior with in the work
place.
Any regulations such as conflict
resolution,employement laws, healthy and
safety measures incorporated within this
policy.
03/25/17 5
 Risk Assessment
Risk Assessment is the first process in the risk
management .
Risk Assessment activities includes,
System characterization,
Threat identification,
Vulnerability identification,
Control analysis,
Likely hood determination,
Impact analysis,
Risk determination,
Control recommendations,
Results Documentation.
03/25/17 6
 Risk Mitigation
Risk Mitigation is the Second process,
The activities includes
Prioritize actions
Evaluate recommended control options
Conduct a cost-benefit analyses
Select controls
Assign responsibility.
Develop safeguard implementation plan.
And implement selected controls.

03/25/17 7
 Safeguards
Authentication
Authorization
Access control Enforcement
Non repudiation
Protected communication
And transaction Privacy.

03/25/17 8
 References
HHS Gov book
And Wikipedia

03/25/17 9