Computer Security Prepared By: Dr. Omar A.

Dawood 4th Stage Computer Science Department

Computer Security - Policies

In this chapter we will explain security policies which are the basis of security for
the technology infrastructure of your company.

In a way they are the regulatory of the behaviors of your employees towards the use
of technology in the workplace, that can minimize the risk of being hacked,
information leak, internet bad usage and it also ensures safeguarding of company
resources.

In real life you will notice the employees of your organization will always tend to
click on bad or virus infected URL’s or email attachments with viruses.

Role of the Security Policy in Setting up Protocols

Following are some pointers which help in setting u protocols for the security policy
of an organization.

 Who should have access to the system?

 How it should be configured?

 How to communicate with third parties or systems?

Policies are divided in two categories −

 User policies

 IT policies.

User policies generally define the limit of the users towards the computer resources
in a workplace. For example, what are they allowed to install in their computer, if
they can use removable storages.

Whereas, IT policies are designed for IT department, to secure the procedures and
functions of IT fields.
1
Computer Security Prepared By: Dr. Omar A. Dawood 4th Stage Computer Science Department

 General Policies − This is the policy which defines the rights of the staff and access
level to the systems. Generally, it is included even in the communication protocol as
a preventive measure in case there are any disasters.

 Server Policies − This defines who should have access to the specific server and with
what rights. Which software’s should be installed, level of access to internet, how they
should be updated.

 Firewall Access and Configuration Policies − It defines who should have access to
the firewall and what type of access, like monitoring, rules change. Which ports and
services should be allowed and if it should be inbound or outbound.

 Backup Policies − It defines who is the responsible person for backup, what should be
the backup, where it should be backed up, how long it should be kept and the frequency
of the backup.

 VPN Policies − These policies generally go with the firewall policy, it defines those
users who should have a VPN access and with what rights. For site-to-site connections
with partners, it defines the access level of the partner to your network, type of
encryption to be set.

Structure of a Security Policy

When you compile a security policy you should have in mind a basic structure in
order to make something practical. Some of the main points which have to be taken
into consideration are −

 Description of the Policy and what is the usage for?

 Where this policy should be applied?

 Functions and responsibilities of the employees that are affected by this policy.

 Procedures that are involved in this policy.

 Consequences if the policy is not compatible with company standards.

2
Computer Security Prepared By: Dr. Omar A. Dawood 4th Stage Computer Science Department

Types of Policies
In this section we will see the most important types of policies.

 Permissive Policy − It is a medium restriction policy where we as an administrator

block just some well-known ports of malware regarding internet access and just some
exploits are taken in consideration.

 Prudent Policy − This is a high restriction policy where everything is blocked

regarding the internet access, just a small list of websites are allowed, and now extra
services are allowed in computers to be installed and logs are maintained for every
user.

 Acceptance User Policy − This policy regulates the behavior of the users towards a
system or network or even a webpage, so it is explicitly said what a user can do and
cannot in a system. Like are they allowed to share access codes, can they share
resources, etc.

 User Account Policy − This policy defines what a user should do in order to have or
maintain another user in a specific system. For example, accessing an e-commerce
webpage. To create this policy, you should answer some questions such as −

o Should the password be complex or not?

o What age should the users have?

o Maximum allowed tries or fails to log in?

o When the user should be deleted, activated, blocked?

 Information Protection Policy − This policy is to regulate access to information, hot

to process information, how to store and how it should be transferred.

 Remote Access Policy − This policy is mainly for big companies where the user and
their branches are outside their headquarters. It tells what should the users access,
when they can work and on which software like SSH, VPN, RDP.

3
Computer Security Prepared By: Dr. Omar A. Dawood 4th Stage Computer Science Department

 Firewall Management Policy − This policy has explicitly to do with its management,
which ports should be blocked, what updates should be taken, how to make changes
in the firewall, how long should be the logs be kept.

 Special Access Policy − This policy is intended to keep people under control and
monitor the special privileges in their systems and the purpose as to why they have it.
These employees can be team leaders, managers, senior managers, system
administrators, and such high designation based people.

 Network Policy − This policy is to restrict the access of anyone towards the network
resource and make clear who all will access the network. It will also ensure whether
that person should be authenticated or not. This policy also includes other aspects like,
who will authorize the new devices that will be connected with network? The
documentation of network changes. Web filters and the levels of access. Who should
have wireless connection and the type of authentication, validity of connection
session?

 Email Usage Policy − This is one of the most important policies that should be done
because many users use the work email for personal purposes as well. As a result
information can leak outside. Some of the key points of this policy are the employees
should know the importance of this system that they have the privilege to use. They
should not open any attachments that look suspicious. Private and confidential data
should not be sent via any encrypted email.

 Software Security Policy − This policy has to do with the software’s installed in the
user computer and what they should have. Some of the key points of this policy are
Software of the company should not be given to third parties. Only the white list of
software’s should be allowed, no other software’s should be installed in the computer.
Warez and pirated software’s should not be allowed.