security policies 6

/in /by

Overview: this report is designed to provide users with an opportunity to

consider a particular organization and design an information assurance program for that organization.

Objective: The goal of the Security Policies Report is to produce a set of policies that represent the

important security issues for your example organization.

Report Requirements: The Security Policies Report will consist of three policy reports. Each should be

written as a separate document according to the following specifications.

Part 1. Enterprise Information Security Policy – The Enterprise Information Security Policy (EISP) is a

general policy specified for the entire organization. You will write a policy for your organization

based on the information you specified about the organization in your proposal. Your EISP

should contain at least the following:

  • Statement of Purpose
  • Information Security Elements
  • Need for Information Security
  • Information Security Responsibilities and Roles
  • Reference to Other Information Standards and Guidelines

    • You can find details about these elements in Table 5-1 of the textbook.

    Here is a list of several example EISPs for real organizations that might be useful in guiding you

    to write your own. These represent examples from educational, governmental and corporate

    organizations.

  • Massachusetts State Information Security Policy: http://www.mass.gov/anf/researchand-tech/cyber-sec…
  • Harvard University’s Enterprise Security Policy: http://policy.security.harvard.edu/
  • Kennesaw State University Enterprise Information Security Policy:

    • https://policy.kennesaw.edu/sites/web.kennesaw.edu…

    on_security_policy-20180614.pdf

    Part 2. Issue Specific Security Policy – An Issue Specific Security Policy (ISSP) is a policy defined for a

    particular issue. In an overall security plan, an organization will provide many ISSPs. For this

    project, you will choose one ISSP and write the policy document. While the specific issue you are

    addressing will drive some specific parts of the policy, there are common components that each

    ISSP should have.

    Your ISSP should contain at least the following:

  • Statement of policy
  • Authorized access and usage of equipment
  • Prohibited usage if equipment
  • System management
  • Violations of policy
  • Policy review and modification
  • Limitations of liability

    • You can find details about these elements in Table 5-2 of the textbook.

    SANS provides a set of security policy templates here:

    http://www.sans.org/security-resources/policies/

    As part of this report, include a short description of how your ISSP may differ from a

    similar/generic ISSP for this issue that you might find on the Internet. That is, how do the

    specific characteristics of your organization affect the policy you are writing?

    Part 3. Systems Specific Security Policy – Systems Specific Security Policies are more focused than EISPs

    or ISSPs. They make up the rules to be implemented to carry out the overall technical policies.

    These rules typically end up being expressed through access control lists or in an intrusion

    detection system. For this report, you will provide some examples to illustrate your

    understanding of the purpose of this type of policy.

    A good description of System Specific Security Policies can be found in the following document

    (Section 5.3):

  • Special Publication 800-12: An Introduction to Computer Security – The NIST Handbook,

    • Section II. Management Controls, Chapter 5: COMPUTER SECURITY POLICY, NIST

    Computer Security Division: Computer Security Resource Center (CSRC).

    Using this document as a guide, provide the following in this report:

  • Three example Security Objectives that reflect policies for your organization.
  • Three example Operational Security Rules that relate to the objectives. Your rules do

    • not have to be comprehensive, just representative. That is, you don’t have to worry

    about covering every possible rule that applies to the stated objectives. Just provide a

    few to indicate your understanding of the concepts.

     
    Do you need a similar assignment done for you from scratch? We have qualified writers to help you. We assure you an A+ quality paper that is free from plagiarism. Order now for an Amazing Discount!
    Use Discount Code "Newclient" for a 15% Discount!

    NB: We do not resell papers. Upon ordering, we do an original paper exclusively for you.