Establishing a security policy is the starting point in designing a secure computer network. It is essential that a set of minimum security requirements be gathered, formalized and included as the basis of your security policy. This security policy must be enforceable by your organization and will create an additional cost to running and monitoring your network. This additional cost/benefit of a security policy must be understood and embraced by your organization's management in order to enhance and maintain network and system security.

The lack of an accepted and well-thought-out security policy and guidelines document is one of the major security vulnerabilities in most companies today. This section discusses several Best Practices related to the production of such a document. In addition, a generic security policy is provided in Appendix B and also on the accompanying CD-ROM. The importance of a meaningful security policy cannot be overemphasized.

INFOSEC Best Practice #1

Perform a threat analysis and risk analysis for your organization to determine the level of security that must be implemented.

First, identify all the threats to your computers and network; second, determine threat categories; third, perform the risk assessment; and, fourth, recommend action. Risk assessment should be performed by constructing a "consequence" matrix vs. "likelihood" matrix ^[1] as shown in Figure 4-1.

Figure 4-1: Risk Rating Matrix

For each threat, construct a likelihood/consequence table. The "likelihood" rating for a threat can use categories such as A = remote, B = unlikely, C = likely, D = highly likely,...