Security Policy Best PracticesA Cisco View

Cisco released a number of excellent SAFE blueprints containing security design guideless. The material at http://www.cisco.com/safe is a must read for any IP engineer or designer.

Too many organizations have not followed the fundamental crucial step of developing a security policy upon which to base all security strategies. Any network without a security policy is liable to be compromised, because when an event does occur, there are no processes in place to mitigate the event efficiently and thoroughly. Hence, an important step for any organization serious about

Security Policy Best Practices—A Cisco View 209

network security is to perform a risk assessment of the current network and then build a security policy that considers that risk assessment. This risk assessment should be carried out on a regular basis and improved when new vulnerabilities are discovered.

NOTE This section presents some of the SAFE recommendations in brief. The examination is very light on this material.

Prior to implementing a security policy, you must do the following:

■ Create usage policy statements—Involves outlining users' roles and functions within an organization. The main purpose of these statements is to ensure that the user communities understand the security policy. The next step is to define a usage policy for partners involved within an organization. Finally, the administrators within the organization must have defined procedures for user account management, policy enforcement, and a regular status review of privileged users.

■ Conduct a risk analysis—Identifies the risks to your current network, resources, and data devices. This involves identifying resources within your network and assigning each critical device an appropriate level of security—low, medium, and high.

■ Establish a security team structure—Involves assembling a cross-functional security team—typically a virtual team (a team of experts that communicates over the phone, Internet, and e-mail) for global companies such as Cisco—lead by a security manager. Each team member is responsible for the technical aspects of the security policy and must be fully aware of the current and future polices that are in place.

The security team in any organization has the fundamental responsibility of ensuring network integrity. In fact, in some parts of the world, the chief information officer can be jailed for not ensuring that the network is secure. The three primary areas of concern for security administrators are the following:

■ Policy development

In addition to the three key areas of policy development, ensure the security policy remains at the forefront to protect data integrity by ensuring there is adequate preparation, prevention, and response.

The following URL provides more details on a security team's core responsibilities and areas of focus (please note requires a CCO login):

http://www.cisco.com/en/US/partner/tech/tk869/tk769/technologies_white_paper 09186a008014f945.shtml#t3

Was this article helpful?

0 0

Post a comment