The area of my job that I probably dislike the most is policies. I like technology and finding ways to make things possible that weren’t possible before; enabling businesses to become more efficient in their day-to-day work by streamlining cumbersome security strategies into slicker operating methodologies. Network security is an excellent arena for someone who loves technology because of the ever changing environment but a constantly changing environment brings challenges with it and the biggest of all is ensuring that when you’re business adapts to meet the challenge, it adapts in a manner that is controlled, directed, managed and monitored. To do that in my job you need a Security Model to operate within.
Security Model by SecuraNET
With new and improved technologies being released every day there are pressures to keep pace with them but without structure you are soon left with a myriad of solutions that are unsupportable and working independently making them difficult to administer and a burden to maintain. When you have the proper framework in place to direct your efforts in the appropriate direction, that is when things start coming together and improving. Security Models are comprised of a number of different elements, all of which you will hear banded around loosely at meetings. The diagram below shows how they slot together to create a security model. The policy is the “why”, standards and baselines are the “what”, and procedures and guidelines are the “how” of the security model.
Policies
The policy, as you can perhaps interpret from the name, is put in place to police the user’s actions. Its purpose is to define how information is managed and dissipated throughout your business and there will usually be polices for key areas. For instance, a common example would be an Acceptable Use Policy that outlines the acceptable use of IT equipment. The aim of the policy is to define the end results and not necessarily the means. The policy may refer to standards, procedures or guidelines and are enforceable which can result in disciplinary action should a member of staff breach them.
Standards & Baselines
A standard is written to describe the mandatory rules that must be followed to adhere with the policy. For example, there will be a standard specified for the allocation of IP addresses that a company uses that may define a specified range for use. They are usually specific to a system or procedure and employees must follow these standards. They are usually industry recognized best practices. ISO27002 is the current ISO standard for Information Security Management. Standards usually describe the baselines for the minimum level of compliance that must be met in order to meet the standards requirements.
Procedures & Guidelines
Without procedures it would be very hard to enforce a policy. With procedures we can effectively instruct the employee into acting in a deliberate manner when carrying out certain tasks. In reference to the earlier example of issuing an IP address range, there may be an IP Address Allocation procedure that instructs the employee to update certain documents with the new details and communicate the details to certain parties. In contrast, guidelines are recommendations that are set out to help comply with the policies objectives by providing a structure or framework to work against. They are meant to guide the employee into acting in a manner that is supportive of the policy or model and in a way that helps them comply better with the standards. There are usually frequent references to the guidelines within the policy document.
There are various ways to interpret how the elements work together, I feel that the policy is a seperate entity but standards and baselines work together to determine the levels of adherence while guidelines and procedures give us the methods in which to acheive these levels so that we may adhere to the policy and work under the model as a whole. This area certainly isn’t my forte but I hope you find the article helpful.
