WHAT BINDS WELL-FORMED IT SECURITY POLICIES together is an organization’s culture of security. Without such a cultural attitude, written policies are far less effective. Within your organization, you will achieve that, in part, by establishing principles that create a shared vision, by empowering others to act, and by institutionalizing support processes. It’s important that the implementation of IT security policies becomes second nature to the organization; that is, business processes should be designed with the controls needed to implement and maintain security policies built in.

For example, consider the issue of emergency access to a server in the middle of the night. Gaining access may require going through a firewall system that will issue an ID and password only when approval by the manager is obtained. In this way, security policies are enforced and cannot be bypassed. However, this process assumes there is an organizational understanding that such controls are important. The extra step of obtaining approval before accessing the server in the middle of the night is of value. Without a security culture, the business may see the process as an unneeded delay, given skilled staff that can be trusted to do the right thing. Defining a shared set of core security principles and vision is vital to how IT security policies are designed and implemented.

This chapter takes a micro look into each document within the collection of policy framework documents.