Hacking Infosec Policies: Cutting Through The Jargon

Information security policies: Everyone hates writing them, everyone hates reading them, but they are a necessary evil for an effective information security program. The trouble is that very few organizations take the time and trouble to create decent policies; instead they are happy to download examples to cut and paste as they see fit. The resulting mess is often no good to anyone and can often leave the organization open to unforeseen issues, especially when an auditor comes calling. We will walk through the process of creating a simple, yet effective, information security policy... from an auditor's point of view.

Transcript

1. HACKING INFOSEC POLICIES: CUTTING THROUGH THE JARGON Darryl MacLeod, Information Security Manager - Securicy | GoSec 2018
2. @darryl_macleod
3. What Is An Infosec Policy? Why Is An Infosec Policy Important? Infosec Policy Contents What Makes A Good Policy?
5. What Is An Infosec Policy?
6. Why Is An Infosec Policy Important?
7. Sets Consistency
8. Sets Expectations
9. Compliance and Audit
10. Management Endorsement
11. Infosec Policy Contents
12. Purpose [ WHY ]
13. A strong password policy will protect OURORG, your employees, and your data from external attacks. 
 When employees follow OURORG’s password policy, they will make their accounts more secure: strong passwords are more difficult to steal or break.
14. Scope and Applicability [ WHERE ]
15. What resources does this policy apply to? • Internal resources, such as email accounts and websites • External accounts, such as vendors, clients, or other online services • Personal devices that are approved for network access, including unlock codes Who needs to read and accept this policy? All employees, whenever they create passwords related to their work with OURORG.
16. Policy [ WHAT ]
17. You must follow this password policy whenever you create a work-related password or unlock code. These are some examples: • Passwords for internal OURORG resources, such as your OURORG email address, your OURORG account login, and any other accounts assigned to you directly • Passwords for external accounts, such as vendors, clients, or other online services • Unlock codes for personal devices that are approved for OURORG network access
18. Roles and Responsibilities [ WHO ]
19. Our [Insert Appropriate Role] has overall responsibility for the day-to-day implementation of this policy.
20. Revision Control and Detail
21. Version Date Name Revision 1.0 August 30, 2018 Darryl MacLeod First draft for GoSec presentation
22. References and Supporting Documentation
23. Standard Requirement Details PCI-DSS 3.2 8.2.4 Users must change their passwords every 90 days.
24. Terms & Definitions
25. What Makes A Good Policy?
26. Relevant To Your Audience
27. Auditable
28. A unique User ID must be assigned to every user. 
 A unique User ID should be assigned to every user.
29. As Short As Possible
30. darryl@securicy.com