Now we will try to describe mistakes that can make security policy ineffective.
A general rule is that a security policy should define both allowed and forbidden use of the system.
Let's try to visualize an effective security policy.
The barrier you can see in the picture is a good metaphor for such a policy.
It was probably placed there to slow down cars driving on a small street.
However as you can see it's easier for the drivers to drive around the barrier than to wait for it to
go up.
That doesn't really make children playing on the grass nearby safer.
A poorly thought out security policy gives similar results.
The bottom line is that you mustn't create a security policy that would make users look for ways to
bypass it.
Now a few words on privacy policy in general if your firm doesn't have a privacy policy how should you
go about creating one.
First you have to describe the threat.
Next you should define the scope of responsibility.
Then you ought to determine who and under what conditions would gain access to the system.
It means you should also specify how to apply for an account or a log in
a real life experience in order to get a log into the I.T. system in a certain company.
A new employee had to go through a very complicated procedure.
They had to fill in a form then get the signatures of their immediate superior.
The I.T. department manager and the branch manager
the application would then go to the I.T. department and they would create an account.
The procedure seems well thought through it certainly prevents unauthorized people from getting an account.
However in a large corporation one day may not be enough to fund both your immediate superior and the
I.T. department manager to get them to sign your application.
And obviously if you don't get the signatures you can't hand in the application and you won't get the
account
if you don't get an account you can't work.
It may not help you make a good impression and a new job.
If you wait three days to start working because you don't have access to the I.T. system
nobody would like to be in such an awkward situation.
So in order to make it all happen faster you would probably call the I.T. Department asking when you
can get the account
and people in the I.T. Department don't like such phone calls.
Well some may think that preparing a number of plinked applications signed beforehand would be a good
idea.
That's what they did in the company I mentioned
after some time they discovered increased traffic on their WWE w server it turned out that somebody
had been using it to store and share films.
Every film was put there by a user by the name of John Doe.
Obviously there had never been a John Doe working in that company.
Sometimes a user account must be deleted.
Therefore a security policy should also state who when and how an account would be deleted.
In one of the next modules we will discuss the issue of password security which is also a part of security
policy.
Security Policy also includes the issues of using network resources local and remote access and data
security users must know how to categorize data by public private confidential and sensitive.
Otherwise you won't be able to get the users to comply with a security policy.
The rules of a security policy should also include internet identity authentication principles.