A security policy outlines how an organization plans to protect its IT assets by balancing trust and control. There are different types of security policies that define standards for encryption, network infrastructure, servers, and more. Providing security training to all users is important for educating them on policies and procedures, as well as new defenses. Training helps reduce risks from social engineering tricks where attackers try to deceive users into providing sensitive information.

1. Jason R McKinney-Halfday
IT210
11-10-2010
chapter 14
Security Policies and Training

2. Organizational security Policies
• It is important to know what a security policy is, how to manage trust and control, and
the process for designing a policy.
• A security policy is basically a document that states how an organization plans to
protect the company’s information technology assets. ( layout, contract, blueprint)
• Balancing Trust and Control is balancing two key elements trust, and control.
• Trust everyone all the time- There are no restrictive. Leaves systems vulnerable to
attack.
• Trust no one at anytime- most restrictive but impractical because few individuals would
work for an organization that did not trust its employees.
• Trust some people some of the time- Access is provided as needed with technical
controls to ensure the trust is not violated.

3. Types of Security Policies
• Acceptable encryption policy- Defines requirements for using
cryptography
• Analog Line policy- Defines standards for use of analog dial-up lines for
sending and receiving faxes and for connection to computers
• Anti-virus policy- establishes guidelines for effectively reducing the
threat of computer viruses on the organization’s network and
computers.
• Demilitarized zone security policy- Defines standards for all networks
and equipment located in the DMZ.
• Router security Policy- Outlines standards for minimal security
configuration for routers and switches.
• Server security policy- Creates standards for minimal security
configuration for routers and switches.

4. Education and Training
• Organizational Training- Responsibility to protect the assets of
the organization.
• Providing users with the knowledge and skills to protect those
assets.
• All users need continuous training in the new security
defenses and to be reminded of company security policies
and procedures.
• Most people are taught using a pedagogical approach (from a
Greek word meaning to lead and child.
• Adult learners, use an andragogical approach (the art of
helping and adult learn) is often preferred.

5. Reducing Risks of Social Engineering
• Social engineering relies on tricking and deceiving someone to
provide secure information.
• Phishing , sending an e-mail or displaying a web
announcement that falsely claims to be from a legitimate
enterprise in and attempt to trick the user into surrendering
private information are all the most common forms of social
engineering.
• Other social engineering tricks include dumpster diving and
shoulder