Computer Security Policy


Published on

Outline of components needed to develop cyber security procedures for public and private institutions.

Published in: Technology, News & Politics
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Computer Security Policy

  2. 2. COMPUTER SECURITY 2 Abstract This paper considers many of challenges faced by internet security professionals. The risks are the same around the world. This research paper suggests taking a holistic approach to this huge problem.
  3. 3. COMPUTER SECURITY 3 COMPUTER SECURITY POLICY Computer security policy needs of industry and government have been a priority since the early 1990’s. These policies relate to internet security, firewalls, virus protection and statistical methods of computer security. Internet security professionals around the world face the same risks when it comes to the lack of needed resources to develop and sustain an effective security policy (Waning Security, 1996, p. 3). A holistic approach in computer security policy is needed (Scientists on Cybersecurity, 2002b, p. 38). The National Research Council, which advises the government on technology matter, examines cybersecurity issues including the nature of cybertrheats and common causes of system and network pboblems. The agency has developed some controversial policy recommendations, such as making software and system vendors legally responsible for insecure products and systems (Scientists on Cybersecurity, 2002c, p. 38). The security risks posed by microcomputers need to be controlled because microcomputers are being used more frequently in large financial reporting systems. These risks include threats to data integrity, unauthorized information access, and theft. A cost-effective security plan should first identify business assets that need protection and risks from which the assets need to be safeguarded. Controls can then be designed and based on the level of exposure to loss. Specific security procedures that can be implemented include (1) policy statements on computer security guidelines, (2) locking devices, (3) password protection, (4) security software such as data
  4. 4. COMPUTER SECURITY 4 encryption programs, and (5) data backup procedures to insure against accidental or intentional destruction of data (Herdman & Neary, 1987b, p. 9). Computer security is not always the answer the protecting a computer system. The cost of the system must be weighed against the cost of damages without it. The purposes of security systems, which are to prevent sabotage, protect confidential information and guard against human error or technical failure must also be considered. Apprehensions about sabotage often come from employee-related or company policy-related problems and computer security only convinces a saboteur to harm the company in another way. Security systems to protect confidential information are effective, but cannot protect against individuals intent on getting information. Although human error and technical failure cannot be eliminated, preventive measures can be taken. Adequate employee training can minimize human error while automatic backup of important information is the best safeguard against technical failure (How Much Computer Security, 1992, p. 12). Research shows that corporate losses due to poor computer security are more likely to result from error than from fraud. Further, more fraud losses are caused by employees than by outsiders. A proper corporate computer security program takes a team approach, with components including ongoing design, education and enforcement. It should begin with an examination of the kinds of information the company deals with, and should consider the level of protection appropriate to each during every phase of its life and regardless of is location or form. Separation of functions, access controls, audit trails, and regular backup are all essential to effective computer security. A well-documented, well-publicized security policy can help
  5. 5. COMPUTER SECURITY 5 companies comply with new federal and state laws and prosecute violators more effectively (Thackeray, 1988b, p. 45) Data security across networks is also an important issue for network administrators. To secure intranetworks, some elements to include in a computer security policy are: (1) permission rules, (2) responsibilities, (3) unauthorized access to files and directories, (4) unauthorized use of software, (5) use of the network in for-profit activities, (6) use of electronic mail, (7) harassment, (8) waste, (9) abuse, (10) theft, (11) enforcement, (12) workplace monitoring, (13) network managers’ responsibilities and (14) the use of the network for non-company tasks (Alexander, 1995b, p. 59). Needed computer security procedures should be implemented after and based on results of a preliminary survey, assignment of security project responsibilities, risk analysis, analysis of defenses against security risks, selection of appropriate defenses, implementation of the security measures identified and periodic audit and improvement of the security program, security controls (i.e. detective measures, preventive measures and insurance coverage). The following procedures are recommended for application by all internet security professionals: 1. Permission – Use of computer facilities must be authorized by the owner of the information or by a senior manage. Prior permission to use another user’s computer account or user-ID from the owner of the account should be required. All computer or electronic files are considered private unless the owner has explicitly made them available to others. 2. Responsibilities – The user is owner of their data. It is their responsibility to ensure that it is adequately protected against unauthorized access. Keep passwords and accounts confidential; change passwords frequently. Do not leave terminals unattended without logging out first. Do not engage in any activity that is intended to circumvent computer
  6. 6. COMPUTER SECURITY 6 security controls. Do not acce3ss the accounts of other with the intent to read, browse, modify, copy or delete files and directories without authorization. 3. Unauthorized Use of Software –Users should be prohibited from loading any software on any computer system (i.e. shareware o freeware software) without approval from the system administrator and your supervisor. Users should be expressly prohibited from using company computers to make illegal copies of licensed or copyrighted software. Copyrighted software must only be used in accordance with its license or purchase agreement. 4. Harassment – Company computer systems are not to be used to harass anyone. This includes the use of insulting, sexist, racist, obscene or suggestive electronic mail, tampering with others’ files invasive access to others’ equipment. Etc. 5. Destruction of Records – Instruct employees how to dispose of old manuals, floppy disks. Shredding and thoroughly erasing floppy disks, removing any information that could be used by an outsider to penetrate a company’s computer system. Recycle ink and toner cartridges. 6. Networks – Disallow use of the company-owned network (or other network accessible by company computers) for any activity other than company business. This includes surfing the Internet, online discussions in newsgroups and bulletin board services, attempting to access other computer systems without authorization, posting commercial messages, and transmitting viruses, worms, or other invasive software. 7. Enforcement – Investigate all alleged abuses of computer resources. Each employee must be responsible for their own actions. A company has the obligation to ensure that its computer resources are used properly and within the guidelines established by the company. The company should have access to all electronic files of its employees. Limiting the access of guilty employees is appropriate. Refer flagrant abuses to senior managers or law enforcement authorities. In extreme cases of flagrant abuse or disregard of computer security guidelines, may result in termination of employment 8. Workplace Monitoring – A company must reserve the right to monitor the computer system for signs of illegal or unauthorized activity. (Alexander, 1995b, p. 59) In conclusion, computer security professionals must be highly trained, continuously updating their education, and constantly vigilant in order to protect their company from intruders who would cause them harm. The computer security professional must have integrity and be trustworthy. The demands made on the individuals entrusted with the responsibility of computer security is making that person increasingly valuable as we become a global community and market place.
  7. 7. COMPUTER SECURITY 7 References Alexander, M. (1995b). Make It a Policy to Protect Yourself. Datamation, 41 (22), 59. Retrieved May 19, 2008, from Herdman, R. K., & Neary, R. D. (1987a). Planning Your Microcomputer Security Strategy. Financial Executive, 3 (4), 9. Retrieved May 19, 2008, from How Much Computer Security. (1992). Across the board, 29 (2), 12. Retrieved May 19, 2008, from Scientists on Cybersecurity. (2002a). Security Management, 46 (4), 38. Retrieved May 19, 2008, from Thackeray, G. (1988a). Computer Security: The Manace is From Inside. The Office, 108 (4), 45. Retrieved May 19, 2008, from