How to devise a security policy?

Question

I've recently been tasked with putting together a security policy for a small startup firm consisting of ~30 people in the UK. Largely up until now there has been nothing concrete in place, however as we're looking to take on clients in the financial and banking services sector this needs to change.

Having very little security experience (I'm a software engineer by day); and working on a very tight deadline, I'm hoping that there are off the shelf templates/guides I can use to aid in drafting this policy. Additionally what would one expect to see in a robust security policy i.e. one a financial service firm might be happy with?

Answer 1

As Eric said in his answer, the SANS site has a great set of security policy templates. BERR, a UK government department, also wrote an excellent document^[PDF] that gives some great structural advice for creating security policies.

I can also offer you the following advice:

• Ask your employees for input when creating the policies. Can they see areas of their work that might be hindered by a particular rule? Can they think of things that you've forgotten?

• Identify what you're trying to protect. If your answer is "the network", you're not thinking hard enough. What assets are important to you? Source code is an obvious one, but SSL certificate private keys, design documents, financial information, purchase orders, etc. are all important to your success.

• Security policy should be combined with a usage policy. Some people dislike this, but it's important to get the right context. The security policy essentially boils down to what a user can and cannot do, and what the should and should not do. Usage is an important extension of this.

• Security policies often get bogged down in what isn't allowed. Don't forget to include exceptions, and a list of things you feel are acceptable (e.g. "browsing semi-NSFW web comics / funny cat picture sites is fine during lunch hours, as long as you know they're reputable and won't perform drive-by browser exploits").

• Don't try to come up with exhaustive lists when a "within reason" clause could be used instead. This allows you to treat things on a case-by-case basis. Expect your employees to find a good balance, and be responsible.

• Include sections of text that explain why a policy is in place. Format these sections differently, e.g. with a lightly shaded background, and explain at the beginning of the document that these sections are not considered a binding part of the policy.

• Policy is about humans, so make it human-readable. For all intents and purposes, lawyers are not human. Just because your document is written in simple, informal language, does not mean that it isn't legally binding or serious. There's absolutely no need for huge blocks of scary legalese in block capitals, exclaiming that "VIOLATIONS OF THE SECURITY POLICY WILL RESULT IN THE EMPLOYEE BEING FIRED OUT OF A CANNON ONTO THE MOON TO GO LIVE WITH WILLZYX AND TOM CRUISE".

• Perhaps most importantly, don't write anything you wouldn't want to agree to yourself. Furthermore, stick to the security policy yourself. If a staff member sees you violating the very security policy you made them sign, your authority is worth zero and the policy is worth zero.

Answer 2

I would highly recommend looking into the SANS site for security policy templates. They are fairly simple policies but would be a very good starting point for you all. When I worked at a university, I used these as a starting point and once I got the basics out of the way, I then started looking at other university's policies so I could compare and contrast what they had to what I had. Once you start comparing to your peers, that will let you know what others will expect from you all.

Answer 3

In addition to Polynomial's excellent answer, I've been seeking "pre-packaged in one complete document or template" solutions for more-general policies/coverage and have thus far found:

• https://www.instantsecuritypolicy.com/products.html
• http://www.information-security-policies.com/
• http://www.myinformationsecuritypolicy.com/collections/all
• http://www.altiusit.com/policies.htm

Health-care and/or Compliance focused:

• https://clearwatercompliance.com/
• http://www.complianceforge.com/affordable-it-security-documentation/iso-27002-written-information-security-program

These "pre-packaged in one document" solutions potentially offer a shorter, easier path to implementation (to serve the tight deadline purpose) than compiling something from a collection of templates or documents.

I welcome comments on any additional, similar sources. If possible I'll add them to the above list.

Collection of templates and related materials:

• SANS (as previously noted)
• http://www.csoonline.com/article/2123889/identity-access/security-tools-templates-policies.html

The following provides a list of in-use policies for (mostly) well-known organizations: Where are some Security Policies that are actually in use?

(Moderator: please mark this post as 'community wiki' if it's appropriate.)