Computer Security Handbook, Fifth Edition

CHAPTER 66

DEVELOPING SECURITY POLICIES

M. E. Kabay and Sean Kelley

66.1 INTRODUCTION

66.2 COLLABORATING IN BUILDING SECURITY POLICIES

66.3 PHASE 1: PRELIMINARY EVALUATION

66.3.1 Introduction to the Study

66.3.2 State of Current Policy

66.3.3 Data Classification

66.3.4 Sensitive Systems

66.3.5 Critical Systems

66.3.6 Authenticity

66.3.7 Exposure

66.3.8 Human Resources, Management, and Employee Security Awareness

66.3.9 Physical Security

66.3.10 Software Development Security

66.3.11 Computer Operations Security

66.3.12 Data Access Controls

66.3.13 Network and Communications Security

66.3.14 Antimalware Measures

66.3.15 Backups, Archives, and Data Destruction

66.3.16 Incident Response

66.3.17 Business Resumption Planning and Disaster Recovery

66.4 PHASE 2: MANAGEMENT SENSITIZATION

66.5 PHASE 3: NEEDS ANALYSIS

66.6 PHASE 4: POLICIES AND PROCEDURES

66.7 PHASE 5: IMPLEMENTATION

66.7.1 Upper Management

66.7.2 Technical Support

66.7.3 Lower-Level Staff

66.7.4 Other Technical Staff

66.8 PHASE 6: MAINTENANCE

66.9 CONCLUDING REMARKS

66.10 NOTES

66.1 INTRODUCTION.

This chapter reviews methods for developing security policies in specific organizations. Some of the other chapters of this Handbook that bear on policy content, development, and implementation are listed next:

• Chapter 23 provides an extensive overview of physical security policies.
• Chapter 25 discusses local area network security issues and policies.
• Chapter 39 reviews software development policies and quality assurance policies. ...