Beginner's Guide to Information Security Policy

As a security policy is an integral part of an information security management program for any organization, understanding the characteristics of what makes up a good security policy is vital. Now, why do you even need security policies? This is due to the fact that without one, a company would not know what processes to follow in order to secure their environment. This policy will establish standards for the organization on what is considered acceptable when working on or when using company property & systems. Creating standards protect the network by providing basic rules or guidelines across the entire organization can help limit the exposure to external threats, provide legal protection, and minimize the risk of a data breach.

It seems we can’t go longer than a few months before we hear of another big data breach from one company or another. Everyone knows of the Equifax breach, but have you heard of the Citrix Systems Data breach that occurred last year?

On March 6th, 2019 the FBI alerted Citrix to the breach where hackers, “removed files from our systems, which may have included files containing information about our current and former employees and, in limited cases, information about beneficiaries and/or dependents.” That information may have included names, social security numbers & financial information. The company later confirmed that the hackers may have had intermittent access to the internal network for about 6 months before the FBI alerted them!

You can now see how having a good security policy in place is imperative. So, what constitutes a “good” security policy?

Below is a great guide that shows the 8 basic elements to building a good security policy:

https://www.exabeam.com/information-security/information-security-policy/