Sample Security Policies

There are a ton of great sample security policies available at the SAN Institute Security Policy Project here. Included in the policies you can download in either Word or PDF format are: Acceptable Encryption Policy Defines requirements for encryption algorithms used within the organization. Acceptable Use Policy Defines acceptable use of equipment and computing services, […]

Read the full article →

Sample Incident Response Policy

Cynthia Bonnette, the Director of Information Security Risk Assessment for NETBankAudit in Arlington, VA wrote a sample incident response policy which appeared in this issue of the AML Compliance Alert here. Here’s an exerpt: INCIDENT IDENTIFICATION, CLASSIFICATION AND ESCALATION Once detected, suspected incidents (e.g., anomalous activity) must be reported. The nature and severity of the […]

Read the full article →

Corporate Security Policy

Randy Bias wrote a helpful article called Architecting Practical Corporate Security Policies here. I especially liked the Example Policy Framework and the suggestions on what should be included in a Corporate Security Policy. Here’s an excerpt: Corporate Security Policy  Audience: Executive Management, particularly the CSO, CISO, and Senior INFOSEC Staff This element is really the […]

Read the full article →

Network Security Investigation

During the course of incident response you’ll want a handy resource to follow while conducting your security investigation. A new special report was published by the National Institute of Justice called “Investigations Involving the Internet and Computer Networks” which you can download here. It’s extremely thorough and covers these topic areas: Tracing an Internet Address […]

Read the full article →

Sample Security Policies

Here’s a great resource for sample security policies from the North Carolina Healthcare Information and Communications Alliance. Tons of sample policies are available for download on a wide variety of topics including: Security Management Process Risk Analysis Risk Management Sanction Policy Information System Activity Review Assigned Security Responsibility Workforce Security Authorization and/or Supervision Workforce Clearance […]

Read the full article →

Incident Reporting Form

Here is a good example of an online incident reporting form that you can use as part of your incident response process. It’s from the State of North Carolina Office of Information Technology Services. Here are some of the areas covered on the form: Physical location (s) of victim’s computer system/network IP Address of attacked […]

Read the full article →

Windows Hardening Guide

First.org has several good examples of Windows hardening guides in their Best Practices Guide Library. Jay Ward wrote the very comprehensive Windows 2003 / IIS 6.0 DMZ Hardening Guidelines. The hardening guide is has 27 steps and is more than 100 pages long. Some of the steps include: Boot up Windows Server 2003 Standard Edition […]

Read the full article →

DataSecurityPolicies.com Recommends first.org Library

The document library at first.org is an excellent resource for anyone developing data security policies and standards. There you can find papers and presentations, a best practices guide library and a security reference index. Best practices guides include: Acceptable Use Policy Template CERT-in-a-box Checking Microsoft Windows Systems for Signs of Compromise Checking UNIX/LINUX Systems for […]

Read the full article →

Acceptable Use Policy Template

The Forum of Incident Response and Security Teams (first.org) has a great Acceptable Use Policy template available for download in their Best Practices Guide Library. You can download it here. Here’s an excerpt from the Overview: The purpose of this policy is to establish acceptable and unacceptable use of electronic devices and network resources at […]

Read the full article →

Incident Response Policy Article

You might want to read this classic article called “How to Design a Useful Incident Response Policy” here. I love this visual representation of a simplistic incident response process:

Read the full article →

← Previous Entries

Next Entries →