Developing Security Policies

Abstract

CHAPTER 46DEVELOPING SECURITY POLICIES M. E. Kabay 46.1 INTRODUCTION. This chapter reviews methods for developing security policies. Some of the other chapters of this Handbook that bear on policy content, development, and implementation are as follows:Chapter 15 provides an extensive overview of physical security policies.Chapter 18 discusses local area network security issues and policies.Chapter 25 reviews software development policies and quality assurance policies.Chapter 28 presents principles, topics, and resources for creating effective security policy guidelines.Chapter 29 looks at methods for enhancing security awareness.Chapter 31 provides guidance on employment policies from a security standpoint.Chapter 32 makes explicit recommendations about operations management policies.Chapter 33 reviews specific recommendations for e-mail and Internet usage.Chapter 35 presents concepts and techniques from social psychology to make security policy implementation more effective.Chapter 39 discusses the policies that apply to application design.Chapter 51 looks at censorship and content filtering on the Internet. COLLABORATING IN BUILDING SECURITY POLICIES.Policies are the foundation of effective information security, but the task of policy creation is complicated by human and organizational resistance. Technology alone does not work. In changing human behavior, rationality and substance are not enough: The process of development affects how people feel about policies and whether they see these rules as needless imposition of power or an expression of their own values.Security is always described as being everyone's business; however, in practice, security interferes with everyone's business. For example, network managers work hard to make networks user-friendly. They do everything they can to make life easier for users; they provide network access routines with a graphical user interface, client-server systems with hot links between local spreadsheets and corporate databases, and a gateway to the Internet for the engineering users. Superficially, one might think that implementing network security would Computer Security Handbook, 4th Edition

Information security policies and value conflict in multinational companies

“…Access controls, for example, can be considered as an effective measure that is enforced by certain security policies. These controls restrict users from series of actions such as downloading files from the internet, installing programs and accessing certain parts of a computer network (Barman, 2002;Kabay, 2002). With respect to enforcing security policies, these restrictions may be problematic in high power distance cultures because adoption of power reducing technologies would be limited in such cultures (Straub et al, 1997).…”