82 Managing Network Vulnerability Assessment
General Program Policy
A general program policy sets the strategic directions of the enterprise for
global behavior and assigns resources for its implementation. This includes
such topics as information management, conflict of interest, employee stan-
dards of conduct, and general security measures.
Topic-Specific Policy
Topic-specific policy addresses specific issues of concern to the organization.
Topic-specific policies might include e-mail usage, Internet usage, phone
usage, physical security, application development, system maintenance, and
network security.
System- or Application-Specific Policy
System- or application-specific policies focus on decisions taken by manage-
ment to protect a particular application or system. System- or application-
specific policy might include controls established for the financial management
system, accounts payable, business expense forms, employee appraisal, and
order inventory.
Policy Contents
When reviewing policies, it will be necessary to remember that there are three
general types of policies:
1. General or global policies. These are high-level policy statements that define
the intent of a specific topic and its scope within the organization. It also
assigns responsibilities for implementation and compliance with the policy.
Typical information security general or global policies include:
– Information security policy
– Information classification policy
– Business continuity planning
2. Topic-specific policies. Key component areas of the information technology
and information security areas are addressed in topic-specific policies.
Unlike the general or global policies, the topic-specific policies narrow the
focus to one issue at a time. Typical subjects for topic-specific policies
include:
– Physical security
– Equipment security
– Network access controls
– Media disposal
– User access
– Technology disaster recovery plan
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.