Security Training Video

Here’s a fun security training video that could be useful to explain the value of security policies and security concepts like defense in depth: I like how it incorporates Second Life as a training tool.  🙂

Read the full article →

Information Security Policy

The educause.edu site has a chapter from the book Computer and Network Security in Higher Education here. It does a good job of describing how university security policies should be written. Here’s an excerpt: If the goal of institutional policies is to direct individual behavior and guide institutional decisions, then the effectiveness of formal policy […]

Read the full article →

University Security Policy

This is a great site to find a ton of actual security policies and procedures used by universities. Here’s a sample of some of the university policies available: Data Handling and Storage Policy (Adams State College) Secure Handling of Social Security Numbers (Northwestern University) Data Access, Security, Classification and Handling (Purdue University) The Payment Card […]

Read the full article →

Incident Response Plan

The IT Security group at the California Department of Techonology Services (DTS) have a security incident response presentation here that describes their incident response plan. This presentation includes a couple of scenarios where they demonstrate how to implement the Security Incident Lifecycle: Security Incident Identification Security Incident Triage Security Incident Response & Resolution Security Incident […]

Read the full article →

Data Security Policy

Joel Weise and Charles R. Martin from Sun wrote an excellent Data Security Policy guide which you can download here. This is a great reference to follow when developing any data security policy. Here’s an excerpt: The purpose of this document is to define the Data Security Policy. Data is considered a primary asset and […]

Read the full article →

Identification and Authentication Policy

Walter Kobus at TESS (http://www.tess-llc.com/) has made available his Identification and Authentication Policy here. His policy covers the key elements required in any Authentication Policy. Here’s an excerpt: Policy Access to the [ORGANIZATION]’s information assets will be granted on different levels, based on the business rules established by data owner’s of that information, for an authorized […]

Read the full article →

Authentication Policy

If you’re planning on writing a policy defining the rules of user authentication, here’s a short and sweet Authentication Policy from Auburn University that might be a helpful reference. Here’s an excerpt: I. PURPOSE To ensure that only authorized users have access to Auburn University computers. II. POLICY Auburn University computers will be configured to […]

Read the full article →

Information Security Classification Policy

There’s a helpful draft Information Security Classification Policy from Rutgers University here. They define three classification levels. Here’s an excerpt: Restricted Data Restricted data is the most sensitive information and requires the highest level of protection. This information is usually described as “non-public information” about people and under the purview of a Data Custodian. Restricted […]

Read the full article →

Outsourcing Policy

I wrote a generic outsourcing policy for a presentation I’m giving on outsourcing security services. Here’s the general outline: Purpose Scope/Applicability Policy Statement Board and Management Responsibility Risk Mitigation Strategies: Outsourcing Team Business Case Due Diligence Business Continuity Management (BCM) Contractual Agreements Management and Control of the Outsourcing Relationship Offshoring Final Approval Here’s an excerpt: […]

Read the full article →

South African Government Security Policies

I found a HUGE document of information security policies on the South African Government Information website: http://www.info.gov.za/ The policies document is almost 500 pages and includes the following chapters: Securing Hardware, Peripherals and Other Equipment Controlling Access to Information and Systems Processing Information and Documents Purchasing and Maintaining Commercial Software Developing and Maintaining In-House Software […]

Read the full article →

← Previous Entries

Next Entries →