CYBER SECURITY
CYBER
SECURITY
UNIT
4
PPT
I
n
f
o
r
m
a
t
i
o
n
s
e
c
u
r
i
t
y
p
o
l
i
c
y
p
o
l
i
c
y
i
s
a
d
o
c
u
m
e
n
t
a
t
i
o
n
o
f
d
e
c
i
s
i
o
n
s
o
n
s
a
feguar
d
in
g
the
•
i
n
f
o
r
m
a
t
i
o
n
s
e
c
u
r
i
t
y
o
r
g
a
n
i
z
a
t
i
o
n
a
l
l
e
v
e
l
i
n
f
o
r
m
a
t
i
o
n
.
•
A
s
e
c
u
r
i
t
y
p
o
l
i
c
y
d
e
f
i
n
e
s
t
h
e
r
u
l
e
s
t
h
a
t
r
e
g
u
l
a
t
e
h
o
w
y
o
u
r
o
r
g
a
n
i
z
a
t
i
o
n
m
a
n
a
g
e
s
a
n
d
p
r
o
t
e
c
t
s
i
t
s
i
n
f
o
r
m
a
t
i
o
n
a
n
d
c
o
m
p
u
t
i
n
g
r
e
s
o
u
r
c
e
s
t
o
a
c
h
i
e
v
e
s
e
c
u
r
i
t
y
o
b
j
e
c
t
i
v
e
s
.
•
Information
security
policy
is
used
to
protect
the
integrity,
confidentiality and
availability
of
organization.
•
It’s the
first, and one of
the most
critical,
steps to securing
your
environment
.
N
e
e
d
f
o
r
I
n
f
o
r
m
a
t
i
o
n
S
e
c
u
r
i
t
y
P
o
l
i
c
y
A security
policy should fulfill
many
purposes.
It
should:
1.
Protect
people and
information
2.
Set
the
rules
for
expected
behavior
by
users,system
administrators,
management,
and
security
personnel
3.
A
u
thori
z
e
security
personne
l
t
o
monitor,
probe,and
investigate
4.
Define and authorize
the
consequences
of
violation1
5.
D
e
fine
the company cons
e
nsu
s
bas
e
l
i
n
e
stance
on
security
6.
Help minimize
risk
7.
Help track compliance with regulations and
legislation
C
h
a
l
l
e
n
g
e
s
f
o
r
s
e
c
u
r
i
t
y
P
o
l
i
c
y
•
Extremely difficult to develop, policy often unique to
each
organization.
•
No
common format
or process
for developing
one.
•
Making it simple
so
everyone can understand and
use
it.
•
Getting management
consensus.
•
How
do you
enforce
it?
processing
•
Ensure
the
avail
a
bilit
y
o
f
dat
a
and
resources to
everyone.
•
Provide
assurance
for the
confidentiality and
integrity of customer data and allow
for the
compartmentalization of, substitution, insertion,
and
deletion of
that
data
risk for customers and your
organization.
•
Ensure the
integrity of data processing
operations
and protect
them from
unauthorized
use.
S
e
c
u
r
i
t
y
P
r
i
n
c
i
p
l
e
s
•
Ensure
the confidentiality of the
customer’s and
your
processed data,
and
prevent unauthorized disclosure or
use.
•
Ensure
the
integrity of the customer’s
and
your
processed data, and
prevent the
unauthorized and undetected
modification.
P
u
r
p
o
s
e
s
o
f
a
S
e
c
u
r
i
t
y
P
o
l
i
c
y
•
The primary purpose of
a security
policy is
to
inform users,
staff, and managers of
those
essential requirements
for
protecting various assets including people, hardware, and
software resources,
and data
assets.
•
The policy
should specify the
mechanisms through which
these
requirements
can
be
met.
•
Another purpose is
to
provide
a
baseline
from
which
to
acquire, configure, and audit
computer
systems and
networks
for
compliance with
the
policy.
T
y
p
e
s
o
f
S
e
c
u
r
i
t
y
p
o
l
i
c
i
e
s
a
n
d
t
h
e
i
r
r
e
v
i
e
w
p
r
o
c
e
s
s
•
Review
process is
also essential
to
ensure that security policy
is
appropriate
or
adequate
•
Various types of security
policies
and
their
review
processes:-
1.
World wide
web
(WWW)
Policy
2.
security
policy
3.
Corporate
Policy
W
W
W
p
o
l
i
c
y
1.
N
o
of
f
ensiv
e
o
r
ha
r
assin
g
mat
eria
l
may
b
e
made
available
through
company
website
2.
No personnel
commercial
advertising should be
made
available
through company
website
3.
Th
e
pers
o
nne
l
mat
eria
l
o
n
o
r
access
i
b
le
f
r
o
m
the
website should be
minimal.
4.
N
o
com
pa
n
y
confid
e
ntia
l
mat
eria
l
sho
u
l
d
made
be
available
5.
Us
e
rs
o
f
a
n
orga
n
i
z
a
tion
shou
l
d
no
t
b
e
permit
t
e
d
to
install or
run
web
server
E
-
m
a
i
l
s
e
c
u
r
i
t
y
p
o
l
i
c
y
1.
Not transmit unsolicited
mass
(spam)
not
to
anyone
2.
Not
send
messages
that
are harassing, hateful or
threatening
3.
Not
send
any
chain
letter
4.
Not
send
message
that
supports
illegal
or unethical
activities
5.
E-mail should not be used
to
send sensitive
information
6.
Not use email broadcasting facilities except
for making
appropriate
announcements
7.
Keep personal email use
to
minimum.
8.
Keep Policy and procedures
secured from
abusers.
9.
Will demonstrate
the same
respect
to
email communication
as
to verbal
communication.
10.
Will check grammar, spelling before
send the
message.
C
o
r
p
o
r
a
t
e
P
o
l
i
c
y
Corporate Policy is the
formal
declaration of
the
principles and polices according
to
which
a
company will operate .These policies and
principles are prepared by board of directors
of
the
company or senior management
committee
.
Corporate policy
comprises:
•
Company’s
mission
statement
•
Company’s
objectives
•
Principles on the basis of which strategic
decisions are
made
P
o
l
i
c
y
R
e
v
i
e
w
P
r
o
c
e
s
s
cr
e
at
e
d
s
h
o
u
l
d
b
e
revi
e
wed
t
o
e
n
s
u
r
e
s
u
ccessf
u
l
p
o
licy
•
Each
policy
appropriately
d
e
vel
o
p
m
e
n
t
.
•
Th
e
re
are
important
st
e
p
s
t
o
be
p
e
rfor
m
ed
six
w
h
ile
evaluating
in
f
o
r
m
a
ti
o
n
security
policy:-
P
o
l
i
c
y
R
e
v
i
e
w
P
r
o
c
e
s
s
A security policy is crucial in safeguarding organizational information, defining rules for managing and protecting data to achieve security objectives. It ensures integrity, confidentiality, and availability, serving as a foundation for securing your environment. Discover the need for an information security policy, its purposes, and challenges, along with key security principles to ensure data protection and confidentiality.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
CYBER SECURITY UNIT 4 PPT
Information security policy policy is a documentation of decisions on safeguarding the information security organizational information. level A security policy defines the rules that regulate how your organization manages and protects its information and computing resources to achieve security objectives. Information security policy is used to protect the integrity, confidentiality and availability of organization. It s the first, and one of the most critical, steps to securing your environment .
Need for Information Security Policy A security policy should fulfill many purposes. It should: 1. Protect people and information 2. Set the rules for expected behavior by users,system administrators, management, and security personnel 3. Authorize security personnel investigate 4. Define and authorize the consequences of violation1 5. Define the company consensus baseline stance on security 6. Help minimize risk 7. Help track compliance with regulations and legislation to monitor, probe,and
Challenges for security Policy Extremely difficult to develop, policy often unique to each organization. No common format or process for developing one. Making it simple so everyone can understand and use it. Getting management consensus. How do you enforce it?
Security Principles processing Ensure the availability of data and resources to everyone. Provide integrity of customer compartmentalization of, substitution, insertion, and deletion of that data risk for customers and your organization. assurance for the confidentiality and allow for and the data Ensure the integrity of data processing operations and protect them from unauthorized use.
Ensure customer s and your processed data, and prevent unauthorized disclosure or use. the confidentiality of the Ensure the integrity of the customer s and your processed data, and prevent the unauthorized and undetected modification.
Purposes of a Security Policy The primary purpose of a security policy is to inform users, staff, and managers of those essential requirements for protecting various assets including people, hardware, and software resources, and data assets. The policy should specify the mechanisms through which these requirements can be met. Another purpose is to provide a baseline from which to acquire, configure, and audit computer systems and networks for compliance with the policy.
Types of Security policies and their review process Review process is also essential to ensure that security appropriate or adequate Various types of security policies and their review processes:- 1. World wide web (WWW) Policy 2. E-mail security policy 3. Corporate Policy policy is
WWW policy 1. No offensive or harassing material may be made available through company website 2. No personnel commercial advertising should be made available through company website 3. The personnel material on or accessible from the website should be minimal. 4. No company confidential material should made be available 5. Users of an organization should not be permitted to install or run web server
E-mail security policy 1. Not transmit unsolicited mass email (spam) not to anyone 2. Not send messages that are harassing, hateful or threatening 3. Not send any chain letter 4. Not send message that supports illegal or unethical activities 5. E-mail should not be used to send sensitive information 6. Not use email broadcasting facilities except for making appropriate announcements 7. Keep personal email use to minimum. 8. Keep Policy and procedures secured from abusers. 9. Will demonstrate the same respect to email communication as to verbal communication. 10.Will check grammar, spelling before send the message.
Corporate Policy Corporate Policy is the formal declaration of the principles and polices according to which a company will operate .These policies and principles are prepared by board of directors of the company or senior management committee . Corporate policy comprises: Company s mission statement Company s objectives Principles on the basis of which strategic decisions are made
Policy Review Process created should be reviewed to ensure successful policy appropriately development. Each policy There performed security policy:- are six while important evaluating steps to be information
