In school, idealistically network is everywhere in the field of university. Technology is really a widespread and seems it touches the heart of every man. Gradually, as anyone would spoke about it, merely they say “I love technologies because it helps in many things. Since people are already capable of living with a life surrounded by different kinds of gadgets, merely do understood its coexistence. The fact that the world has it, humans somehow lives an easy life. Though technology may be there to supply the needs still perfections can never be achieve. Disadvantages is truly inevitable, people whom are knowledgeable just tend to lessen the bad effects. Technology specialists are there to accompany the issues system or may be network faced. They are known to repair problems and create effectiveness by means of giving good service to its user. If we are to consider a college university implementing networking structure by midst of handling a number of computers from different colleges and offices, what comes out unto my mind are the users. If somehow they still feel contented of the service being provided. Others would just think about the situation that if there are many users, somehow, the flow of connections will be affected. The personnel whom take in charge of the network is finding his way of blocking social networking cites, games, and other prohibited cites that could somehow make the internet connections slow. As a matter of fact, slow internet connections mainly are the cause of lots of student head aches. One goes upon ones mind as to how certain things are managed down the network and how do services equally distributed to its student. As what I thoroughly understand about when it comes to the accounted service student had overcome in the line of network, most of those used computers seems to give not so good service at all, but in terms of new ones, their advantages is high. Evidently, they are good ones because new things try to develop and experiment what could be of good deliverability to its users. Even there are new down the line of course people should maintain the capability of its computer. If people have the sense, it just only relies as to how they will take care and maintain the effectiveness of their devices. Technologies could be of good service but they were not in fact there always to maintain its good service still it needs someone for continuity.
Moving on to what the group had taken upon the distribution of questions to the said network specialist, he barely answered some of it personally. I just attach everything I learn and understood about his answers.
A. Reyes stated that “[T]alking about hardware component and technology used, basically I, assigned as the network administrator, am entrusted to maintain our different servers to run 24/7. Currently, we have our Web Server hosted here in our University in our HP ProLiant ML350 Server. It’s an old but stable server set-up here in our Networks Office and has been active since Engr. Val A. Quimno, not yet a dean was appointed as the Network Administrator. The said server has the following specification:
• Intel Xeon 3.0 GHz, 3.2 GHz, or 3.4 GHz processors (dual processor capability) with 1MB level 2 cache standard. Processors include support for Hyper-Threading and Extended Memory 64 Technology (EM64T)
• Intel® E7520 chipset
• 800-MHz Front Side Bus
• Integrated Dual Channel Ultra320 SCSI Adapter
• Smart Array 641 Controller (standard in Array Models only)
• NC7761 PCI Gigabit NIC (embedded)
• Up to 1 GB of PC2700 DDR SDRAM with Advanced ECC capabilities (Expandable to 8 GB)
• Six expansion slots: one 64-bit/133-MHz PCI-X, two 64-bit/100-MHz PCI-X, one 64-bit/66-MHz PCI-X, one x4 PCI-Express, and one x8 PCI-Express
• New HP Power Regulator for ProLiant delivering server level, policy based power management with industry leading energy efficiency and savings on system power and cooling costs
• Three USB ports: 1 front, 1 internal, 1 rear
• Support for Ultra320 SCSI hard drives (six hot plug or four non-hot plug drives supported standard, model dependent)
• Internal storage capacity of up to 1.8TB; 2.4TB with optional 2-bay hot plug SCSI drive
• 725W Hot-Plug Power Supply (standard, most models); optional 725W Hot-Pluggable Redundant Power Supply (1+1) available. Non hot plug SCSI models include a 460W non-hot plug power supply.
• Tool-free chassis entry and component access
• Support for ROM based setup utility (RBSU) and redundant ROM
• Systems Insight Manager, SmartStart, and Automatic Server Recovery 2 (ASR-2) included
• Protected by HP Services and a worldwide network of resellers and service providers. Three-year Next Business Day, on-site limited global warranty. Certain restrictions and exclusions apply. Pre-Failure Notification on processors, memory, and SCSI hard drives.
Aside from it, our mail server running under Compaq Proliant ML330 Server, our oldest server, is also hosted here in our Networks Office. Together with other Servers, such as Proxy and Enrollment Servers, both proxy and our enrollment servers are running in a microcomputer/personal computer but with higher specifications to act as servers.
All Servers are connected in a shared medium grouped as one subnetwork. In general, our network follows the extended star topology which is connected to a DUAL WAN Router that serves as the load balancer between our two Internet Service Providers. All other workstations are grouped into different subnetworks as in star topology branching out from our servers subnetwork as in extended star topology. At present, we are making use of class C IP Address for private IP address assignments. Other workstations IP assignments are configured statically (example: laboratories) while others are Dynamic (example: offices). All workstations are connected via our proxy servers that do some basic filtering/firewall to control users’ access to the internet aside from router filtering/firewall management. So, whenever any workstation has to connect to the internet, it has to pass through software and hardware based firewall.
All workstations are connected via a proxy server. It means that whenever a workstation is turned on, it requests for an IP address from the proxy server (for dynamically configured IP address) and connect to the network after IP address is acquired. As connection is established, each system can now communicate and share resources within the same subnet work and to server following the concepts discuss in your Computer Network Class.
Basically, our servers are expected to be in good condition since it is required to be up 24/7. Daily, during my vacant period, monitoring on the servers are observed that includes checking logs, checking hardware performance such as CPU health, etc. If problems are observed, remedies are then and then applied. Once in a week, regular overall checkup is observed as preventive maintenance to ensure not to experience longer downtime if possible.
As I was appointed as the Network Administrator, everything was already in place except for some minor changes. Basically, different networking standards was already observed such as cabling standards, TIA/EIA 568A-B, different IEEE standards as discussed in your Computer Networks Subject, etc.
As I have mentioned, we have implemented both software and hardware based filtering/firewall. Basically, Risks or vulnerabilities and different mitigation techniques were considered to increase security in our network. Aside from filtering/firewall, constant monitoring on networks activity also increases the security of the system.
Major Interferences are normally encountered as an effect of unforeseen and beyond our control events such as black outs, and the like. The said interference would of course affect University’s day-to-day businesses for obviously this will paralyze all our activities that rely on electricity and further this might cause damage on our network devices, etc. that may later be the reason for longer downtime. Problems encountered by our providers such as connection to the National/International Gateway also affect University’s business such as correlating to University’s Business Partners outside and within the country.
With regards to the book I read about Networking authored by G. Keiser stated that to which also relates to what the university specialist talks about that “Once the hardware and software elements of a local area network (LAN) have been properly installed and successfully integrated, they need to be managed to ensure that the required level of network performance is met. In addition, the network devices must be monitored to verify that they are configured properly to ensure that corporate policies regarding network use and security procedures are followed. This is carried out through network management, which is a service that users a variety of, hardware and software tools, applications, and devices to assist human networks.
In an actual system different groups of network operations personnel normally take separate responsibilities for issues such as administration aspects, performance monitoring, networking integrity, access control and security. There is no special method of organization may take a different approach to fit its own needs. There are two categorize being used namely LAN element management and LAN operations management. The first deals with administrative and performance aspects of individual network components, whereas the second is concerned with the operation with the LAN as a whole and its interaction with other networks.
What would probably be an aide for an effective and efficient network environment ideal for the university is to know the basic network management functions. These are performance, configuration, accounting, and fault and security management.
Performance Management
In carrying out Performance Management a system will monitor parameter such as network throughputs, user response times, line utilization, and the number of seconds during which error occur, and the number of bad messages delivered. This function also is responsible for collecting traffic statistics and applying controls to prevent congestion. Another performance management function is to monitor control the quality of service continually. This may include assigning threshold values to performance or resource parameters and informing the management system or generating alarms when these thresholds are exceeded. Examples of resource parameters include memory usage, free disk space, and the number of concurrent logins or sessions.
Performance Management also permits proactive planning. For example, a software-based capacity-planning tool can used to predict how network growth will affect performance metrics. Capacity planning involves plans to ensure that the network will be able to support the anticipated resources.
Configuration Management
The goal of Configuration Management is to monitor both network setup information and network device configurations in order track and manage the effects on network generation of the various constituent hardware and software elements. Configuration management allows a system to provide network resources and services, to monitor and control their state and to collect status information. This provisioning includes reserving bandwidth for a user, distributing software to computers, scheduling jobs, and updating applications and corporate computers. In addition, information technology support personnel need to know what hardware, operating system, and application software resources are installed on both fixed and mobile computers.
Accounting Management
The purpose of accounting management is to measure network utilization parameters so that individuals or groups of users on the networks can be regulated and billed for services appropriately. This regulation maximizes the fairness of network access across all users since network resources can be allocated based on their capacities. Thus accounting management is responsible for measuring, collecting, and recording statistics on resource and network usage. In addition, accounting management is also may examine current patterns in order to allocate network usage quotas.
Fault Management
Faults in a network, such as physical cuts in a communication line or failure of a circuit card, can cause portions of a network to be in gradable. Since network faults can result system downtime or unacceptable network degradation, fault management is one of the most widely implemented and important network management functions. With the growing dependence of people on network resources for carrying out their work and communications, users expect rapid and reliable resolution on network resources for carrying out their work and communications, users expect rapid and reliable resolution on network fault conditions. Fault management involves the following process:
- Detecting fault or degradation symptoms, this usually is done through alarm surveillance.
- Determining the origin and possible cause of faults either automatically or through the interaction of a network manager.
- Once the faults are isolated, the system issues trouble tickets that indicate what the problem is and possible means of how to resolve it.
- Once the problem has been fixed, the repair is operationally tested on all major subsystems on the network.
Security Management
The ability of users to gain worldwide access to information resources easily and rapidly has made network security is major concern among network administrator. In addition, the mind of network users and personnel who telecommute to access corporate data from outside of the corporation presents another dimension to network security. LAN security covers number of disciplines including:
-Develop security policies and principles
-Creating security architecture for the network
-Implementing special firewall software to prevent unauthorized access of corporate information from the Internet.
-Applying encryption techniques to certain types of traffic.
-Setting up virus protection software
-Establishing access authorization procedures
-Enforcing network security
The principal goal of network security management is to establish and enforce guidelines to control access to network resources. This content is recorded to prevent unintentional sabotage of network capabilities and to prevent viewing or modification of sensitive information by people who do not have appropriate access authorization.
On a certain research paper I had read, it points about policies and guidelines to have an effective network management whish I find helpful. It stated that:
Policies and guidelines are IT security policies, organizational security, asset classification and control, personnel security, operation management and information management. These guidelines if implemented by the appropriate authorities will go a long way in alleviating problems of network insecurity.
IT Security Policy
IT security policies are the rules and practices that an institution uses to manage and protect its information resources. These policies must be developed, documented, implemented, reviewed and evaluated to ensure a properly managed and secured network. Hence, the need for IT security policies in any institution cannot be overemphasized.
Developing Security Policies
Developing security policies involves developing the following: Program policies, System-specific policies and Issue-specific policies [1], [2].
Program policies: addresses overall IT security goals and it should apply to all IT resources within an institution. The institution’s president or an appointed representative must direct policy development to ensure that the policies address the IT security goals of all systems operating within the institution. For instance, program policies can address confidentiality or service availability. All program policies should meet the following criteria:
•Comply with existing laws, regulations, and state and federal policies.
•Support and enforce the institution’s mission statement and organizational structure.
System-specific policies: addresses the IT security issues and goals of a particular system. Large facilities may have multiple sets of system-specific policies that address all levels of security from the very general (access control rules) to the particular (system permissions that reflect the segregation of duties among a group of employees).
Issue-specific polices address particular IT security issues such as, Internet access, installation of unauthorized software or equipment, and sending/receiving e-mail attachments.
Once you have identified the IT security issues you need to address, develop issue-specific policies using the components defined in table 2
The guidelines for developing security policies are:
•Obtain a commitment from senior management to enforce security policies.
•Establish working relationships between departments, such as human resources, internal audit, facilities management, and budget and policy analysis.
•Establish an approval process to include legal and regulatory specialists, human resources specialists, and policy and procedure experts. Allow enough time for the review and respond to all comments whether you accept them or not.
Implementing Security Policies
Successful implementation of IT security policies requires security awareness at all levels of the organization. You can create awareness through widely disseminated documentation, newsletters, e-mail, a web site, training programs, and other notifications about security issues. Table 4 outlines the guidelines for implementing IT security policies:
Reviewing and Evaluating Policies
Institutions/organizations should review their security policies periodically to ensure they continue to fulfill the institutions security needs. Each department is also responsible for reviewing and evaluating the effectiveness of their policies and the accompanying procedures. After an institution/organization has developed IT security policies, the appointed security team will evaluate the policies and provide feedback.
Policy Review within the Institution
Each institution/organization should develop a plan to review and evaluate their IT security policies once they are in place. The guidelines are [2]:
Moving on to what the group had taken upon the distribution of questions to the said network specialist, he barely answered some of it personally. I just attach everything I learn and understood about his answers.
A. Reyes stated that “[T]alking about hardware component and technology used, basically I, assigned as the network administrator, am entrusted to maintain our different servers to run 24/7. Currently, we have our Web Server hosted here in our University in our HP ProLiant ML350 Server. It’s an old but stable server set-up here in our Networks Office and has been active since Engr. Val A. Quimno, not yet a dean was appointed as the Network Administrator. The said server has the following specification:
• Intel Xeon 3.0 GHz, 3.2 GHz, or 3.4 GHz processors (dual processor capability) with 1MB level 2 cache standard. Processors include support for Hyper-Threading and Extended Memory 64 Technology (EM64T)
• Intel® E7520 chipset
• 800-MHz Front Side Bus
• Integrated Dual Channel Ultra320 SCSI Adapter
• Smart Array 641 Controller (standard in Array Models only)
• NC7761 PCI Gigabit NIC (embedded)
• Up to 1 GB of PC2700 DDR SDRAM with Advanced ECC capabilities (Expandable to 8 GB)
• Six expansion slots: one 64-bit/133-MHz PCI-X, two 64-bit/100-MHz PCI-X, one 64-bit/66-MHz PCI-X, one x4 PCI-Express, and one x8 PCI-Express
• New HP Power Regulator for ProLiant delivering server level, policy based power management with industry leading energy efficiency and savings on system power and cooling costs
• Three USB ports: 1 front, 1 internal, 1 rear
• Support for Ultra320 SCSI hard drives (six hot plug or four non-hot plug drives supported standard, model dependent)
• Internal storage capacity of up to 1.8TB; 2.4TB with optional 2-bay hot plug SCSI drive
• 725W Hot-Plug Power Supply (standard, most models); optional 725W Hot-Pluggable Redundant Power Supply (1+1) available. Non hot plug SCSI models include a 460W non-hot plug power supply.
• Tool-free chassis entry and component access
• Support for ROM based setup utility (RBSU) and redundant ROM
• Systems Insight Manager, SmartStart, and Automatic Server Recovery 2 (ASR-2) included
• Protected by HP Services and a worldwide network of resellers and service providers. Three-year Next Business Day, on-site limited global warranty. Certain restrictions and exclusions apply. Pre-Failure Notification on processors, memory, and SCSI hard drives.
Aside from it, our mail server running under Compaq Proliant ML330 Server, our oldest server, is also hosted here in our Networks Office. Together with other Servers, such as Proxy and Enrollment Servers, both proxy and our enrollment servers are running in a microcomputer/personal computer but with higher specifications to act as servers.
All Servers are connected in a shared medium grouped as one subnetwork. In general, our network follows the extended star topology which is connected to a DUAL WAN Router that serves as the load balancer between our two Internet Service Providers. All other workstations are grouped into different subnetworks as in star topology branching out from our servers subnetwork as in extended star topology. At present, we are making use of class C IP Address for private IP address assignments. Other workstations IP assignments are configured statically (example: laboratories) while others are Dynamic (example: offices). All workstations are connected via our proxy servers that do some basic filtering/firewall to control users’ access to the internet aside from router filtering/firewall management. So, whenever any workstation has to connect to the internet, it has to pass through software and hardware based firewall.
All workstations are connected via a proxy server. It means that whenever a workstation is turned on, it requests for an IP address from the proxy server (for dynamically configured IP address) and connect to the network after IP address is acquired. As connection is established, each system can now communicate and share resources within the same subnet work and to server following the concepts discuss in your Computer Network Class.
Basically, our servers are expected to be in good condition since it is required to be up 24/7. Daily, during my vacant period, monitoring on the servers are observed that includes checking logs, checking hardware performance such as CPU health, etc. If problems are observed, remedies are then and then applied. Once in a week, regular overall checkup is observed as preventive maintenance to ensure not to experience longer downtime if possible.
As I was appointed as the Network Administrator, everything was already in place except for some minor changes. Basically, different networking standards was already observed such as cabling standards, TIA/EIA 568A-B, different IEEE standards as discussed in your Computer Networks Subject, etc.
As I have mentioned, we have implemented both software and hardware based filtering/firewall. Basically, Risks or vulnerabilities and different mitigation techniques were considered to increase security in our network. Aside from filtering/firewall, constant monitoring on networks activity also increases the security of the system.
Major Interferences are normally encountered as an effect of unforeseen and beyond our control events such as black outs, and the like. The said interference would of course affect University’s day-to-day businesses for obviously this will paralyze all our activities that rely on electricity and further this might cause damage on our network devices, etc. that may later be the reason for longer downtime. Problems encountered by our providers such as connection to the National/International Gateway also affect University’s business such as correlating to University’s Business Partners outside and within the country.
With regards to the book I read about Networking authored by G. Keiser stated that to which also relates to what the university specialist talks about that “Once the hardware and software elements of a local area network (LAN) have been properly installed and successfully integrated, they need to be managed to ensure that the required level of network performance is met. In addition, the network devices must be monitored to verify that they are configured properly to ensure that corporate policies regarding network use and security procedures are followed. This is carried out through network management, which is a service that users a variety of, hardware and software tools, applications, and devices to assist human networks.
In an actual system different groups of network operations personnel normally take separate responsibilities for issues such as administration aspects, performance monitoring, networking integrity, access control and security. There is no special method of organization may take a different approach to fit its own needs. There are two categorize being used namely LAN element management and LAN operations management. The first deals with administrative and performance aspects of individual network components, whereas the second is concerned with the operation with the LAN as a whole and its interaction with other networks.
What would probably be an aide for an effective and efficient network environment ideal for the university is to know the basic network management functions. These are performance, configuration, accounting, and fault and security management.
Performance Management
In carrying out Performance Management a system will monitor parameter such as network throughputs, user response times, line utilization, and the number of seconds during which error occur, and the number of bad messages delivered. This function also is responsible for collecting traffic statistics and applying controls to prevent congestion. Another performance management function is to monitor control the quality of service continually. This may include assigning threshold values to performance or resource parameters and informing the management system or generating alarms when these thresholds are exceeded. Examples of resource parameters include memory usage, free disk space, and the number of concurrent logins or sessions.
Performance Management also permits proactive planning. For example, a software-based capacity-planning tool can used to predict how network growth will affect performance metrics. Capacity planning involves plans to ensure that the network will be able to support the anticipated resources.
Configuration Management
The goal of Configuration Management is to monitor both network setup information and network device configurations in order track and manage the effects on network generation of the various constituent hardware and software elements. Configuration management allows a system to provide network resources and services, to monitor and control their state and to collect status information. This provisioning includes reserving bandwidth for a user, distributing software to computers, scheduling jobs, and updating applications and corporate computers. In addition, information technology support personnel need to know what hardware, operating system, and application software resources are installed on both fixed and mobile computers.
Accounting Management
The purpose of accounting management is to measure network utilization parameters so that individuals or groups of users on the networks can be regulated and billed for services appropriately. This regulation maximizes the fairness of network access across all users since network resources can be allocated based on their capacities. Thus accounting management is responsible for measuring, collecting, and recording statistics on resource and network usage. In addition, accounting management is also may examine current patterns in order to allocate network usage quotas.
Fault Management
Faults in a network, such as physical cuts in a communication line or failure of a circuit card, can cause portions of a network to be in gradable. Since network faults can result system downtime or unacceptable network degradation, fault management is one of the most widely implemented and important network management functions. With the growing dependence of people on network resources for carrying out their work and communications, users expect rapid and reliable resolution on network resources for carrying out their work and communications, users expect rapid and reliable resolution on network fault conditions. Fault management involves the following process:
- Detecting fault or degradation symptoms, this usually is done through alarm surveillance.
- Determining the origin and possible cause of faults either automatically or through the interaction of a network manager.
- Once the faults are isolated, the system issues trouble tickets that indicate what the problem is and possible means of how to resolve it.
- Once the problem has been fixed, the repair is operationally tested on all major subsystems on the network.
Security Management
The ability of users to gain worldwide access to information resources easily and rapidly has made network security is major concern among network administrator. In addition, the mind of network users and personnel who telecommute to access corporate data from outside of the corporation presents another dimension to network security. LAN security covers number of disciplines including:
-Develop security policies and principles
-Creating security architecture for the network
-Implementing special firewall software to prevent unauthorized access of corporate information from the Internet.
-Applying encryption techniques to certain types of traffic.
-Setting up virus protection software
-Establishing access authorization procedures
-Enforcing network security
The principal goal of network security management is to establish and enforce guidelines to control access to network resources. This content is recorded to prevent unintentional sabotage of network capabilities and to prevent viewing or modification of sensitive information by people who do not have appropriate access authorization.
On a certain research paper I had read, it points about policies and guidelines to have an effective network management whish I find helpful. It stated that:
Policies and guidelines are IT security policies, organizational security, asset classification and control, personnel security, operation management and information management. These guidelines if implemented by the appropriate authorities will go a long way in alleviating problems of network insecurity.
IT Security Policy
IT security policies are the rules and practices that an institution uses to manage and protect its information resources. These policies must be developed, documented, implemented, reviewed and evaluated to ensure a properly managed and secured network. Hence, the need for IT security policies in any institution cannot be overemphasized.
Developing Security Policies
Developing security policies involves developing the following: Program policies, System-specific policies and Issue-specific policies [1], [2].
Program policies: addresses overall IT security goals and it should apply to all IT resources within an institution. The institution’s president or an appointed representative must direct policy development to ensure that the policies address the IT security goals of all systems operating within the institution. For instance, program policies can address confidentiality or service availability. All program policies should meet the following criteria:
•Comply with existing laws, regulations, and state and federal policies.
•Support and enforce the institution’s mission statement and organizational structure.
System-specific policies: addresses the IT security issues and goals of a particular system. Large facilities may have multiple sets of system-specific policies that address all levels of security from the very general (access control rules) to the particular (system permissions that reflect the segregation of duties among a group of employees).
Issue-specific polices address particular IT security issues such as, Internet access, installation of unauthorized software or equipment, and sending/receiving e-mail attachments.
Once you have identified the IT security issues you need to address, develop issue-specific policies using the components defined in table 2
The guidelines for developing security policies are:
•Obtain a commitment from senior management to enforce security policies.
•Establish working relationships between departments, such as human resources, internal audit, facilities management, and budget and policy analysis.
•Establish an approval process to include legal and regulatory specialists, human resources specialists, and policy and procedure experts. Allow enough time for the review and respond to all comments whether you accept them or not.
Implementing Security Policies
Successful implementation of IT security policies requires security awareness at all levels of the organization. You can create awareness through widely disseminated documentation, newsletters, e-mail, a web site, training programs, and other notifications about security issues. Table 4 outlines the guidelines for implementing IT security policies:
Reviewing and Evaluating Policies
Institutions/organizations should review their security policies periodically to ensure they continue to fulfill the institutions security needs. Each department is also responsible for reviewing and evaluating the effectiveness of their policies and the accompanying procedures. After an institution/organization has developed IT security policies, the appointed security team will evaluate the policies and provide feedback.
Policy Review within the Institution
Each institution/organization should develop a plan to review and evaluate their IT security policies once they are in place. The guidelines are [2]:
Documentation guideline for security policy
Guideline: Define policies
Description:
Define policies by documenting the following information:
•Identify general areas of risk.
•State generally how to address the risk.
•Provide a basis for verifying compliance through audits.
•Outline implementation and enforcement plans.
•Balance protection with productivity.
Guideline: Define standards
Description:
Define IT security standards by documenting the following information:
•Define minimum requirements designed to address certain risks.
•Define specific requirements that ensure compliance with policies.
•Provide a basis for verifying compliance through audits.
•Outline implementation and enforcements plans.
•Balance protection with productivity.
Guideline: Define guidelines
Description:
Define IT security guidelines by documenting the following information:
•Identify best practices to facilitate compliance
•Provide additional background or other relevant information
Guideline: Define enforcement
Description:
Define how policies will be enforced by documenting the following information:
•Identify personnel who are authorized to review and investigate breaches of policy.
•Identify the means to enforce policies.
Guideline: Define exceptions
Description:
Define the possible exceptions to the IT security policies.
Description:
Define policies by documenting the following information:
•Identify general areas of risk.
•State generally how to address the risk.
•Provide a basis for verifying compliance through audits.
•Outline implementation and enforcement plans.
•Balance protection with productivity.
Guideline: Define standards
Description:
Define IT security standards by documenting the following information:
•Define minimum requirements designed to address certain risks.
•Define specific requirements that ensure compliance with policies.
•Provide a basis for verifying compliance through audits.
•Outline implementation and enforcements plans.
•Balance protection with productivity.
Guideline: Define guidelines
Description:
Define IT security guidelines by documenting the following information:
•Identify best practices to facilitate compliance
•Provide additional background or other relevant information
Guideline: Define enforcement
Description:
Define how policies will be enforced by documenting the following information:
•Identify personnel who are authorized to review and investigate breaches of policy.
•Identify the means to enforce policies.
Guideline: Define exceptions
Description:
Define the possible exceptions to the IT security policies.
Guidelines for implementing IT security policies
Guideline: Create awareness
Description:
Create user awareness using the following methods:
•Notify employees about the new security polices.
•Update employees on the progress of new security policies.
•Publish policy documentation electronically and on paper.
•Develop descriptive security documentation for users.
•Develop user-training sessions.
•Require new users to sign a security acknowledgement.
Guideline: Maintain awareness
Description:
Maintain user awareness of ongoing and new security issues using the following methods:
•Web site
•Posters
•Newsletters
•E-mail for comments, questions, and suggestions
•Assign responsibility for reviewing policies and procedures.
•Implement a reporting plan in which departments report security incidents to designated
•Implement regular reviews to evaluate the following:
- Nature, number, and impact of recorded security incidents.
- Cost and impact of controls on business efficiency, including third-party vendor compliance.
- Effects of changes to organizations or technology.
Reference:
G. Keiser, “Local Area Networks.”
Jonathan Gana KOLO and Umar Suleiman DAUDA, “Network Security: Policies and Guidelines for Effective Network Management.”
