Where are some Security Policies that are actually in use?

Question

I know there are a lot of security policy samples and templates out in the web. I'm curious to know if there are security policies that are actually in use and still published publicly. I know they are out there so I'm inquiring here to see if anyone else has knowledge of companies or organizations that publish these policies for everyone to see. If you know of any please provide the link and even better if you know why it's posted publicly that would perfectly satiate my curiosity in the matter.

Answer 1

I was just recently looking at Yammer's the other day: pdf

A couple others I have seen:

MIT

University of MI

Answer 2

This may be seen more as a template than a policy, but I think it's worth mentioning here.

The U.S. National Institute of Standards and Technology has a number of Special Publications (SPs) regarding the security of information systems. These are collectively called the 800 series, as all of them have numeric designations beginning with 800. They are used by some government organizations, and I imagine some corporations have adopted the concepts as well.

Perhaps the most significant of these (and the most relevant to this question) is NIST SP 800-53, "Recommended Security Controls for Federal Information Systems and Organizations". As of this writing (Jan. 29, 2011), the most recent version of this document is Rev. 3 and can be downloaded as a PDF here:

http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf

I could write a whole paper describing what this document is, how to read it, and how to use it. Here, I think it is sufficient to say that it provides a strong foundation from which an organization can build a Security Plan for the protection of its IT systems.

Answer 3

Many companies are very nervous about publishing their policies for obvious reasons. The merit of those reasons, however, is beside the point. On the other hand, I have had great luck finding such policies at educational sites.

Because of the specific environment within an educational institution standards and policies are typically made publicly available. The reasons are many and vary depend on the culture of the institution, but are often something along the lines of an inherent notion of "giving back" to the community. Based on that, you can find a significant number of hits using a standard Google search.

These are a few that I have used for reference over the years either for their policies/standard, or for the types of information they make available:

• UC Berkley - IT Security Policies
• University of Pennsylvania
• University of Notre Dame
• Cornell University - IT Security Policies
• Ohio University - Information Security Standards

Answer 4

Against:

• Cost - some organisations feel that their policies should be their intellectual property and as they cost money to develop should not just be given to others
• Data Leakage - does the policy leak information which may be useful to an attacker? Many organisations will not have resource to spare to check, so take the blanket decision to keep them all private

For:

• Shared environments - if you have a good set of policies, your customers, partners etc could use them to improve their own security, leading to a safer business environment and benefiting your organisation indirectly
• Reputation - if your policy appears very good, this can tie in with a strong security reputation, which may dissuade certain classes of attacker they may aim for lower hanging fruit

Examples

• Couple of academics - Bath Uni and City of London
• A good example of using a security policy for 3rd parties - the DWP
• Large company - British Energy (very brief policy)