Evaluating a Network Security Policy

Just as the preceding section showed that different organizations can have different perceptions of threats and place different values on assets, the security policy reflects those differences. Most security studies agree that some of the key characteristics of a security policy should include the following:

• It must be implementable through network administration technologies, by publishing rules and acceptable use policies, or other appropriate methods.

• It must be enforceable with security tools, where appropriate, and with sanctions, where actual prevention isn’t technically or financially feasible.

• It must clearly define the areas of responsibility for the users, administrators, and management. Maybe as important, it should clearly identify the limits of authority for each group under predictable circumstances.

Any policy that has serious deficiencies in any of these characteristics stands a better- than-good chance of failing to meet the company objectives.