Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've recently been tasked with putting together a security policy for a small startup firm consisting of ~30 people in the UK. Largely up until now there has been nothing concrete in place, however as we're looking to take on clients in the financial and banking services sector this needs to change.

Having very little security experience (I'm a software engineer by day); and working on a very tight deadline, I'm hoping that there are off the shelf templates/guides I can use to aid in drafting this policy. Additionally what would one expect to see in a robust security policy i.e. one a financial service firm might be happy with?

share|improve this question
    
What kind of security policy? Secure development methodology, secure working processes, IT security policy, physical security policy, or all of the above? Notice that SANS has a lot of different policy types! –  Polynomial Jul 24 '12 at 15:18
    
All of the above! –  dbotha Jul 24 '12 at 15:19

2 Answers 2

up vote 5 down vote accepted

As Eric said in his answer, the SANS site has a great set of security policy templates. BERR, a UK government department, also wrote an excellent document[PDF] that gives some great structural advice for creating security policies.

I can also offer you the following advice:

  • Ask your employees for input when creating the policies. Can they see areas of their work that might be hindered by a particular rule? Can they think of things that you've forgotten?

  • Identify what you're trying to protect. If your answer is "the network", you're not thinking hard enough. What assets are important to you? Source code is an obvious one, but SSL certificate private keys, design documents, financial information, purchase orders, etc. are all important to your success.

  • Security policy should be combined with a usage policy. Some people dislike this, but it's important to get the right context. The security policy essentially boils down to what a user can and cannot do, and what the should and should not do. Usage is an important extension of this.

  • Security policies often get bogged down in what isn't allowed. Don't forget to include exceptions, and a list of things you feel are acceptable (e.g. "browsing semi-NSFW web comics / funny cat picture sites is fine during lunch hours, as long as you know they're reputable and won't perform drive-by browser exploits").

  • Don't try to come up with exhaustive lists when a "within reason" clause could be used instead. This allows you to treat things on a case-by-case basis. Expect your employees to find a good balance, and be responsible.

  • Include sections of text that explain why a policy is in place. Format these sections differently, e.g. with a lightly shaded background, and explain at the beginning of the document that these sections are not considered a binding part of the policy.

  • Policy is about humans, so make it human-readable. For all intents and purposes, lawyers are not human. Just because your document is written in simple, informal language, does not mean that it isn't legally binding or serious. There's absolutely no need for huge blocks of scary legalese in block capitals, exclaiming that "VIOLATIONS OF THE SECURITY POLICY WILL RESULT IN THE EMPLOYEE BEING FIRED OUT OF A CANNON ONTO THE MOON TO GO LIVE WITH WILLZYX AND TOM CRUISE".

  • Perhaps most importantly, don't write anything you wouldn't want to agree to yourself. Furthermore, stick to the security policy yourself. If a staff member sees you violating the very security policy you made them sign, your authority is worth zero and the policy is worth zero.

share|improve this answer
    
Forgive my naivety, I've been doing a lot of searching and I'm wondering how the ISO/IEC 27000-series fits into all of this? Should we be aligning our security functions with standards in this series. If so which ones should we look into. Is it possible to seek accreditation? –  dbotha Jul 25 '12 at 16:56
    
The ISO/IEC 27000-series is essentially a security standard in of itself, focusing on secure storage and handling practices, as well as secure methodologies. I'm not sure you need to be 100% compliant as a small company, since the scope of it is massive. However, it's certainly worth reading through and understanding it. I'm sure there are ways to get accredited, but I've never looked into them. –  Polynomial Jul 26 '12 at 10:16

I would highly recommend looking into the SANS site for security policy templates. They are fairly simple policies but would be a very good starting point for you all. When I worked at a university, I used these as a starting point and once I got the basics out of the way, I then started looking at other university's policies so I could compare and contrast what they had to what I had. Once you start comparing to your peers, that will let you know what others will expect from you all.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.