\section{Creating a Security Policy}

\begin{frame}
   {Creating a Security Policy}

   The security policy should:

   \begin{itemize}
      \item Be simple and easy to understand
      \item Get constantly updated
      \item Be in the form of a written document in addition to
      online documentation if needed
      \item Describe both policies and procedures.
      \item Specify enforcement actions
      \item Specify actions to take in response to a security
      breach
   \end{itemize}

\end{frame}

\cprotect\note{

   Policies should be generic and not hard to grasp as that
   makes them easier to follow.  They must safeguard the
   data that needs protection, deny access to required
   services and protect user privacy.

   These policies should be updated on a regular basis;
   policies need to change as requirements do.  Having an
   out of date policy can be worse than having none.

}


\begin{frame}
   {What to Include in the Policy}

   \begin{itemize}
      \item Confidentiality
      \item Data Integrity
      \item Availability
      \item Consistency
      \item Control
      \item Audit
   \end{itemize}

\end{frame}

\cprotect\note{

   A security policy should include methods of protecting
   information from being read or copied by unauthorized
   personnel.  It should also include protection of
   information from being altered or deleted without the
   permission of the owner.  All services should be
   protected so they are available and not degraded in any
   manner without authorization.

   You should make sure that the data is correct and the
   system behaves as it is expected to do.  There should be
   processes in effect to determine who is given access to
   your system.  The human factor is the weakest link in
   the security chain; it requires the most attention
   through constant auditing.

}



\begin{frame}
   {What Risks to Assess}

   \begin{itemize}
      \item What do I want to protect?
      \item What am I protecting against?
      \item How much time, personnel, and money is needed to
      provide adequate protection?
   \end{itemize}
\end{frame}

\cprotect\note{

   What is to be protected (identify assets), what is
   being protected against (identify threats), and what
   will it take to protect the system are the basis of
   Risk Analysis.  Risk analysis is the first step in
   computer security.

   You must know what you are protecting and what you are
   protecting against in order to determine how to protect
   your systems. This allows you to then plan policies and
   procedures to protect your systems.

   This is the first step taken in constructing a computer
   security policy.  It is a pre-requisite for planning
   and then enforcing policies and procedures to protect
   your systems.

}


\begin{frame}
   {Choosing a Security Philosophy}
   \begin{itemize}

      \item There are basically two philosophies in use in most
      computing environments
      \begin{itemize}
         \item Anything not expressly permitted is denied
         \item Anything not expressly forbidden is permitted
      \end{itemize}
      \item Remember:
      \begin{enumerate}
         \item
         The human factor is the weakest link
         \item
         No computing environment is invulnerable
         \item
         Paranoia is a good thing
      \end{enumerate}
   \end{itemize}

\end{frame}

\cprotect\note{

   The first choice is tighter: a user is allowed to do
   only what is clearly and explicitly specified as
   permissible without privilege.  This is the most
   commonly used philosophy.

   The second choice builds a more liberal environment
   where users are allowed to do anything except what is
   expressly forbidden.  It implies a high degree of
   assumed trust and is less often deployed for obvious
   reasons.


   Some general guidelines to remember when developing
   security philosophies are:

   \begin{enumerate}
      \item
      \textbf{The human factor is the weakest link}.

      You must educate your users and keep them happy. The
      largest percentage of break ins are internal and are
      not often malicious.
      \item
      \textbf{No computing environment is invulnerable}.

      The only secure system is one that is not connected
      to anything, locked in a secure room and turned off.

      \item

      \textbf{Paranoia is a good thing}.

      Be suspicious, be vigilant and persevere when
      securing a computer. It is an ongoing process which
      must be constantly paid attention to. Check process,
      users, and look for anything out of the ordinary.

   \end{enumerate}

   Users should never put the current directory in their
   path, i.e, do not do something in \filelink{~/.bashrc}
   like: \texttt{PATH=./:\$PATH} This is a significant
   security risk; a malicious person could substitute for
   a program with one of the same name, that could do
   harmful things.  Just think of a script named
   \textbf{ls} that contains just the line:
   \texttt{/bin/rm -rf \$HOME} If you were to go to the
   directory that contains this file and type \textbf{ls},
   you would wipe out your home directory!

}



