Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So I know what SHOULD be in an AUP. This question circulates more around how do I explain to my bosses the importance of having an AUP and ensuring everyone not only knows of it but understands the value and consequences of it.

We are an eCommerce company based on the East Coast that ship nationally and to several other countries. Our orders are all processed via the web by users on our operations teams that utilize their PCs/Macs to 1. Login to the admin consoles, 2. Manage Orders and 3. Handle administrative tasks and email

Are there any specific laws or studies that point to the value of needing an AUP for Internet Access and to safe guard confidential data?

EDIT - We DO handle Credit Card Info. We do not store the numbers (yet..internal debate and reasoning for this). Some people may have access to such data though (Even yb calling to our CC Gateway provider to get the number in certain cases). This means we are bound by PCI-DSS Requirements

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

The strongest case for AUP is that you can address or discipline risky behaviour before it bites you rather than having to mop up afterwards.

On the compliance front there is the issue of employer liability for employee actions on the Internet (which I believe is an issue in the US). If the workstations handle or share a network with systems which handle credit card data you could also invoke the final requirement of PCI-DSS which states that you must "Maintain a policy which addresses information security".

share|improve this answer
    
Thanks. I'll edit but yes we will be required to be PCI-DSS Compliant so this will help greatly! –  CogitoErgoSum Feb 22 '11 at 19:44
add comment

Two key points that really should sell this:

  • If you don't have a policy, the law appears to assume that you implicitly approve all behaviour by your staff. So you may take on liability for your staff committing crimes using your systems. (caveats - I am not a lawyer, and I really have only seen this in the UK and US)
  • If you don't have a policy that defines the activities you wish to prohibit, and that is signed up to by all employees, you will also find it difficult to take disciplinary action if they do something you find unacceptable.
share|improve this answer
    
Can you reference any specific case for your first point regarding implicit approval? –  CogitoErgoSum Feb 22 '11 at 19:44
    
Sadly, no. And my point was very sweeping as I don't know enough of the detail. Suffice it to say the three companies involved were all told they could have taken appropriate controls but didn't, and they ended up paying fines. –  Rory Alsop Feb 22 '11 at 19:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.