Importance of Corporate Security Policy
In today's high-tech and interconnected world, every corporation needs a well thought out security policy. Threats exist from both within the walls of each enterprise as well as from external sources such as hackers, competitors and foreign governments. The goal of corporate security policies is to define the procedures, guidelines and practices for configuring and managing security in your environment. By enforcing corporate policy, corporations can minimize their risks and show due diligence to their customers and shareholders.
I. Why Have A Security Policy?
Information security is a business issue, not just a technology issue. The reason organizations want to protect information should be for sound business purposes. Corporate knowledge and data are arguably the most important assets of any organization. Corporations must ensure the confidentiality, integrity and availability of their data. These three security objectives answer the questions: "Who sees the data?", "Has the data been corrupted?" and "Can I access the server or data when I need it?"
Corporate Security Policies provide several benefits. They provide a standard baseline of security policy modules and checks, based on the organization's information security policies and standards. They establish a solid, scaleable basis for an enterprise-wide product deployment such as ESM. Policies heighten security awareness of company personnel. They also help organizations demonstrate their commitment to protecting their vital information assets.
Having a security policy that is easily measured and enforced is key. Tools, such as Symantec Enterprise Security Manager (ESM) are designed to measure enterprise-wide security policy compliance. It answers the question "How secure are we?" The Symantec Security Response team provides pre-configured security policies based on industry standards and best practices, easing the burden of effective security policy development. Policies are designed very specifically, protecting the confidentiality, integrity, and availability of your data.
II. Where To Start
The first step toward implementing information security is to formulate a security policy. Identify the key assets to secure, and which assets will be extended to whom. The role of the policy is to guide users in knowing what is allowed, and to guide administrators and managers in making choices about system configuration and use. This process will help you establish specific security goals and a plan to tackle them. Before you can manage security you have to have a way to measure its effectiveness. Your corporate security policy provides the acceptable baseline standards against which to measure compliance.
There is no need to start from scratch. Rather than analyzing every risk, look at what others are doing. Meet standards of due care by using existing standards and industry "best practices". Pay attention to regulations and requirements from government, industry and partners.
Some small organizations have the tendency to define security policy from the bottom up, starting with the capabilities of the tools at hand. Medium and large enterprises know that sound security policies begin from the top down.
As the policy pyramid shows, the best security begins with upper management creating an actual policy or mandate to implement security. The policy should be based on industry standards and regulations such as ISO 17799 and HIPAA. Procedures, guidelines and practices form the basis for all security technology. Products such as ESM measure policy compliance with modules and policies for operating systems, databases and applications. These then interact with the actual computer environment.
A thorough security policy doesn't stay static. It is a living document, changing with corporate needs. It evolves to guard against perceived threats and changing system architectures. Tools to implement and measure corporate security policy compliance exists in products like Symantec Enterprise Security Manager and Symantec NetRecon.
Organizations must also maintain a "best practice" level of compliance, in order to pass audits measured against standards and regulations.
III. Standards And Regulations
A host of information security standards and government regulations have been published over the years providing a great foundation for corporate security policy.
Standards are often based on user consensus or international adaptation. The ISO/IEC 17799 international standard is based on security requirements established by the British Government form BS 7799 Part I. Its stated purpose is to "give recommendations for information security management for use by those who are responsible for initiating, implementing or maintaining security in their organization". The Center for Internet Security (CIS) is an emerging worldwide standards consortium developing benchmarks to determine if minimum standards of due care are taken. The SANS/FBI Top 20 Internet Security Threats combines top 10 lists from multiple security vendors and experts.
Regulations are developed by U.S. and foreign governments to address specific industries such as finance and health care. HIPAA defines security and privacy standards for the health care industry. The Gramm-Leach-Bliley Act is legislation addressing financial services in the United States.
The table below lists several standards and regulations that enterprise customers and government agencies are required to adhere to.
IV. Symantec's Vulnerability Management Products
A large portion of a corporate security policy is proactive in nature. Tools that help measure risk as well as security policy compliance are often grouped under the category of vulnerability management (VM) products. This is equivalent to the physical security analogy of "putting locks on the doors." Intrusion detection products should also be deployed. These tend to be reactive in nature. This is equivalent to the physical security analogy of "sounding burglar alarms." Both are needed. Both should work together and compliment each other.
Symantec currently offers two enterprise-class VM products to assess risk and measure policy compliance. Symantec ESM is a host-based policy compliance product, while Symantec NetRecon is a network-based vulnerability assessment tool.
Symantec Enterprise Security Manager 5.5
Symantec NetRecon 3.5
V. Symantec's Security Policy Compliance Services
Companies may have an information security policy to protect critical assets and sensitive data, but they rarely have the means to effectively monitor compliance in accordance with that policy. Symantec provides clients with the means to monitor compliance with information security policies in a way that fully supports their business requirements. Symantec's Security Policy Compliance Implementation Service ensures proper security planning and policy definition, then installs, deploys and optimizes the benefits of ESM.
ESM defines acceptable activities and system configuration standards for a diverse set of operating systems. Companies use ESM to automatically check for security policy violations and generate concise reports.
The Security Policy Compliance Implementation Service provides the following:
Organizations need security policies, standards and procedures to enforce information security in a structured way. The choice of policies needed by the organization should be acquired through a thorough risk analysis, which includes security vulnerability assessments. The assessment results, combined with a proper policy framework and standards, should determine which policies are needed for your organization. Using tools such as Symantec Enterprise Security Manager can assist in measuring corporate policy compliance. Additional services can ensure the corporate policy is always up to date and implemented correctly. Corporate security policy is absolutely essential for securing an organization.