Security Policies

This chapter is about security policies. I know it’s not an exciting topic, but it is mandatory in building a solid information security program. We will be discussing how security policies meet the laws and regulations that are required by your industry. We’ll cover the differences between policies, procedures, and guidelines. We’ll discuss the fact that following your security policies shows due diligence. Finally, we’ll discuss two major breaches and how policies played a role.

In this chapter, we’re going to cover the following main topics:

• Where are your policies, and are they being used?
• Compliance begins with laws and regulations
• Importance of due diligence

Where are your policies, and are they being used?

One of your first tasks in building out an information security program is to review the company’s information security policies. You need to ask the following questions:

• Where are the security policies?
• Are the policies being followed?
• When were they last updated and reviewed?
• Is there a documented sign-off for employees?

Your security policies set a baseline of security, including actions that the entire company must follow. They show due diligence and provide consistency across your organization. Policies are meant to be high-level so that they can be applied across departments and the entire organization. It’s imperative the organization is aware of the policies and that they are followed. There needs to be an annual review of the key security policies that all employees sign off on after reviewing the policies. Alternatively, an “employee handbook” summarizing the policy can...

Compliance begins with laws and regulations

No company says, “I love compliance because it makes my company more secure.” Compliance is seen as a pain. Many people see it as something that slows your company down from what they need and want to be doing. As a CISO, compliance can be your ally. You can use it to bolster your security program. Maybe you want to segment your network to ensure it’s not flat. In addition, you want to segment critical assets from the main network. Your company may not see segmentation as a priority. As the CISO, you can tie the risk of a flat network into your risk register. You can review the compliance standards for your company and use a standard or framework to give your idea more weight. As an example, if your company is using the National Institute of Science and Technology (NIST) Cybersecurity Framework (CSF) as their framework, then you could leverage control PR.AC-5: Network integrity is protected, which specifically calls out...

Importance of Due diligence

If you are a CISO, then you must ensure your company has a corporate security policy. Ideally, you should have a full set of security policies, as listed earlier in the chapter. If your company is hacked, whether you have a security policy or not, it can be used as evidence that your company has or has not done its due diligence to ensure the company’s network is secure. After the notorious Equifax hack, in subsequent legal filings, Equifax was cited as having a poor security policy and not doing its due diligence in protecting its network. More specifically, the 2019 class action lawsuit states deficiencies such as using a username and password of “admin” on an externally facing portal that stored PII data. The lawsuit goes on to state Equifax was not using known good cybersecurity hygiene practices, such as multi-factor authentication, nor adequately monitoring its own networks9. It’s bad enough getting hacked, but then to have...

Summary

In conclusion, having a solid set of security policies lays the groundwork for your security program. Your security policies should be reviewed annually and approved. A subset of your policies should be reviewed by all employees and signed off. This ensures that all employees are informed of what is expected of them and how the security practices of the company work.

In the next chapter, we will be covering security and risk management, which is the process of balancing cyber risks, the controls to thwart attacks, and a budget. As a CISO, it is a balancing act to decide on what to prioritize and what risks are acceptable.