Policies are the backbone to any security infrastructure, as they provide a framework and support mechanism for all your other efforts. To help you get the year off to a good start, I've compiled highlights from our top five tips of 2003. There's no better time to dust off those policies and resolve to give them the attention they need.
5. Don't forget what you don't see.
Your traveling and remote users may be out of sight, but they shouldn't be out of mind. In fact, the laptops they use could be the missing piece of that great big puzzle that is your organization's security policy. Read the tip Laptop security policy: Key to avoiding infection and learn how a laptop policy not only completes the policy picture, but secures your organization from malware attacks as well.
4. Cover all your bases.
While you aren't rewriting War and Peace, you should be as comprehensive as possible. A thorough security policy addresses numerous points, as demonstrated in the tip The security policy document library: Firewall policy by Ed Tittel.
3. Be reasonable.
Your end-users should be able to comprehend and abide by the policies that you set forth. This includes your policy pertaining to passwords. Learn how to develop a password policy that's user friendly and supports strong passwords in the tip Password policy worst practices, by Mike Chapple, CISSP.
2. Understand what a security policy is.
You've heard the words countless times, and you know you need one. But do you really know what a security policy is? Read Writing a security policy, by Cyrus Peikari and Seth Fogie, to ensure you're applying your time and effort appropriately.
1. Don't start from scratch.
You aren't the only IT manager facing the Herculean task of writing security polices. Before you even pick up your pen – or open a Word doc – check out the examples and templates provided by the resources outlined in the tip Security policy by example.
