Title: Information Security Policy, Standards and Practices
Course: IN 2001 Principle of Information Assurance > Section: Module 5: Chapter Five

Information Security Policy, Standards and Practices
1. Management from all communities of interest must consider policies as the basis for all information security planning, design, and deployment.
2. In general, policies direct how issues should be addressed and how technologies should be used.
3. They should not specifically explain how to properly operate hardware or software. Policy should never contradict law.
4. Quality security programs begin and end with policy.
5. As information security is primarily a management rather than a technical problem, policy guides personnel to function in a manner that will add to the security of its information assets.
6. Security policies are the least expensive control to execute, but the most difficult to implement properly.
7. Shaping policy is difficult because it must:
  - Never conflict with laws
  - Stand up in court, if challenged
  - Be properly administered through dissemination and documented acceptance

Definitions
1. A policy is a plan or course of action used to convey instructions from an organization’s senior-most management to those who make decisions, take actions and perform other duties.
2. Policies are organizational laws in that they dictate acceptable and unacceptable behavior within the context of the organization’s culture.  Like laws, policies must contain information on what is right and wrong, what the penalties are for violating policy, and what the appeal process is.
3. Standards, on the other hand, are more detailed statements of what must be done to comply with policy. They have the same requirement for compliance as policy.
4. The level of acceptance of standards may be informal, as in de facto standards.  Or standards may be published, scrutinized, and ratified by a group, as in formal or de jure standards.
5. Practices, procedures, and guidelines effectively explain how to comply with policy.
6. The mission of an organization is a written statement of an organization’s purpose. The vision of an organization is a written statement about the organization’s goals.  Strategic planning is the process of moving the organization towards its vision.
7. In general, a security policy is a set of rules that protect an organization’s assets.  An information security policy provides rules for the protection of the information assets of the organization.
8. According to The National Institute of Standards and Technology’s Special Publication 800-14, management must define three types of security policy:
  - Enterprise information security policies
  - Issue-specific security policies
  - Systems-specific security policies
9. For a policy to be effective and legally enforceable, it must be properly disseminated, read, understood, agreed to and enforced equally upon all members of the organization.

Enterprise Information Security Policy (EISP)
1. An enterprise information security policy (EISP) is also known as a general security policy, organizational security policy, IT security policy or information security policy.  This policy sets the strategic direction, scope and tone for all security efforts within the organization.
2. The EISP is an executive-level document, usually drafted by or with the CIO of the organization and is usually between two and 10 pages long.
3. According to the National Institute of Standards and Technology (NIST), the EISP typically addresses compliance in the following two areas:
  - General compliance to ensure meeting the requirements to establish a program and the responsibilities assigned therein to various organizational components
  - The use of specified penalties and disciplinary action
4. When the EISP has been developed, the CISO begins forming the security team and initiating the necessary changes to the information security program.
5. EISPs vary from organization to organization, but most EISP documents should include the following elements:
  1. An overview of the corporate philosophy on security
  2. Information on the structure of the information security organization and individuals who fulfill the information security role
  3. Fully articulated responsibilities for security that are shared by all members of the organization (employees, contractors, consultants, partners, and visitors)
  4. Fully articulated responsibilities for security that are unique to each role within the organization

Issue-Specific Security Policy (ISSP)

1. As an organization executes various technologies and processes to support routine operations, certain guidelines are needed to instruct employees to use these technologies and processes properly.
2. In general, the ISSP:
  - Addresses specific areas of technology
  - Requires frequent updates
  - Contains a statement on the organization’s position on a specific issue
3. There are a number of ways to create and manage ISSPs within an organization.  Three of the most common are:
  - Create a number of independent ISSP documents, each tailored to a specific issue
  - Create a single comprehensive ISSP document that covers all issues
  - Create a modular ISSP document that unifies policy creation and administration, while maintaining each specific issue’s requirements

Example of an Issue-Specific Policy Statement Framework
1. Statement of policy
  - The policy should begin with a clear statement of purpose.  The introductory section should outline the scope and applicability of the policy.
  - What does this policy address?
  - Who is responsible and accountable for policy implementation?
  - What technologies and issues does the policy document address?
2. Authorized access and usage of equipment.
  - This section of the policy statement addresses who can use the technology governed by the policy and what it can be used for
  - This section defines “fair and responsible use” of equipment and other organizational assets and should also address key legal issues, such as protection of personal information and privacy
3. Prohibited use of equipment
  - This section outlines what the issue or technology cannot be used for.  Unless a particular use is clearly prohibited, the organization cannot penalize its employees
4. Systems management
  - There may be some overlap between an ISSP and a systems-specific policy, but this section of the policy statement focuses on the user’s relationship to systems management
  - It is important to identify all responsibilities delegated to both users and systems administrators to avoid confusion
5. Violations of policy
  - This section describes the penalties for violating policy
  - This section also provides instructions on how to report policy violations
6. Policy review and modification
  - Each policy should contain procedures and a timetable for periodic review
7. Limitations of liability
  - The final section is a general statement of liability or disclaimers
  - The policy should state that if employees violate a company policy or any law using company technologies, the company will not protect them and is not liable for their actions

Systems-Specific Policy (SysSP)

1. While issue-specific policies are formalized as written documents to be distributed to users and agreed to in writing, SysSPs are frequently codified as standards and procedures to be used when configuring or maintaining systems.
2. Systems-specific policies can be combined into a single policy document or separated into two groups: managerial guidance and technical specifications.
3. Managerial Guidance SysSPs
  - A managerial guidance SysSP document is created by management to guide the implementation and configuration of technology, as well as to address the behavior of people in the organization in ways that support the security of information
  - Any system that affects the confidentiality, integrity, or availability of information must be assessed to evaluate the trade-off between improved security and restrictions
4. Technical Specifications SysSPs
  - While a manager can work with a systems administrator to create managerial policy as described in the preceding section, the system administrator may in turn need to create a policy to implement the managerial policy
  - A systems administrator can implement a technical control within a specific application to enforce managerial policy.  There are two general methods of implementing such technical controls: access control lists and configuration rules
  - Access control lists (ACLs) consist of the user access lists, matrices, and capability tables that govern the rights and privileges of users. A capability table specifies which subjects and objects users or groups can access; in some systems, capability tables are called user profiles or user policies
  - Both the Microsoft Windows NT/2000 and Novell Netware 5.x/6.x families of systems translate ACLs into sets of configurations that administrators use to control access to their respective systems.  ACLs allow configuration to restrict access from anyone and anywhere
  - ACLs regulate:
    - Who can use the system
    - What authorized users can access
    - When authorized users can access the system
    - Where authorized users can access the system from
  - Configuration rule policies are the specific instructions entered into a security system that govern how it reacts to the data it receives
  - Rule policies are more specific than ACLs to the operation of a system and may or may not deal with users directly
  - Many security systems require specific configuration scripts that tell the systems what actions to perform on each set of information they processes
  - Many organizations create a single document that combines the management guidance SysSP and the technical specifications SysSP
  - This combination SysSP, while somewhat confusing to casual users, is practical since it puts the guidance from both managerial and technical perspectives in a single place
5. Policy Management
  - Policies are living documents that must be managed and nurtured, as they constantly change and grow. These documents must be properly disseminated and managed
  - Special considerations should be made for organizations undergoing mergers, takeovers and partnerships
  - In order to remain viable, these policies must have:
    - A policy administrator: the individual responsible for creation, revision, distribution and storage of the policy
    - A properly organized schedule of reviews
    - A mechanism by which individuals can comfortably make recommendations for revisions
    - A date of origin, along with the date(s) of any revisions and a sunset clause if necessary
6. Automated Policy Management
  - In response to needs articulated by information security practitioners, a new category of software for managing information security policies has emerged
  - While many software products meet specific technical control needs, there is now software to meet the need for automating some of the busywork of policy management