CMU5XX-INFOSEC

Information Security for Industry

Session 3: Information Security Policies & Procedures

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Deconstruct the Security Policy Hierarchy (Policies, Standards, Guidelines, Procedures).
  • Draft an enforceable Acceptable Use Policy (AUP).
  • Analyze the role of ISO/IEC 27001 in corporate governance.
  • Understand the mechanisms of policy enforcement and auditing.
  • Evaluate the legal and HR implications of policy violations.

Seminar Structure (3 Hours)

Part 1: The Policy Hierarchy (1.5 hrs)
  • Why Policies Matter (The Foundation of Governance)
  • Policies vs Standards vs Procedures
  • Task 1: Drafting an Acceptable Use Policy (AUP)
Part 2: Frameworks & Enforcement (1.5 hrs)
  • ISO 27001 and Information Security Management Systems (ISMS)
  • Auditing and HR Implications
  • Task 2: Policy Violation Analysis

Part 1: The Policy Hierarchy

Duration: 1.5 Hours

Why Policies Matter

Technology cannot solve management problems.

  • A firewall rule is a technical control. A policy is the business justification for why that firewall rule exists.
  • If an employee installs unauthorized software that causes a breach, you cannot legally fire them or hold them accountable unless a written, signed policy explicitly forbade that action.
  • Policies protect the organization from liability.

The Policy Hierarchy

  • Policy (Mandatory): High-level statement of management intent. "All corporate data must be protected in transit." Does not specify technology. Rarely changes.
  • Standard (Mandatory): Specific technical requirements to meet the policy. "All data in transit must use TLS 1.3 or higher." Changes as technology evolves.
  • Procedure (Mandatory): Step-by-step instructions. "To configure TLS 1.3 on Apache, edit the httpd.conf file..."
  • Guideline (Optional): Recommendations and best practices. "We recommend using Let's Encrypt for certificate generation."

Acceptable Use Policy (AUP)

The most important document an employee signs during onboarding.

  • Defines exactly what an employee can and cannot do on corporate hardware and networks.
  • No Expectation of Privacy: The AUP must explicitly state that the company monitors all traffic on its network. If it doesn't, monitoring employees might violate privacy laws.
  • Shadow IT: Must prohibit the use of unauthorized cloud services (e.g., using personal Dropbox accounts for company files).

Introduction to Task 1

A policy that is too vague cannot be enforced. A policy that is too strict will be ignored by employees trying to do their jobs.

We will draft a realistic Acceptable Use Policy clause for a modern, remote-first workforce.

Task 1: Drafting an Acceptable Use Policy

Timing: 45 minutes

A marketing agency allows its 50 employees to work remotely. They recently suffered a data leak because an employee used an unapproved AI writing tool and pasted client data into it.

  1. Draft a formal AUP clause (max 100 words) specifically governing the use of Generative AI tools on corporate devices.
  2. Ensure the language clearly differentiates between "Policy" (the rule) and "Standard" (the approved/banned tools).
  3. What is the HR consequence if an employee refuses to sign this new AUP addendum?

15 Minute Break

Please return promptly for Part 2.

Part 2: Frameworks & Enforcement

Duration: 1.5 Hours

ISO/IEC 27001

The international standard for an Information Security Management System (ISMS).

  • It is not a technical checklist. It is a management framework for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving security.
  • Continuous Improvement: Based on the Plan-Do-Check-Act (PDCA) cycle.
  • Certification: Companies undergo rigorous external audits to prove they adhere to their own policies. ISO 27001 certification is often a legal requirement to win government contracts.
Practical Resource: ISO 27001 Standards

Enforcement & Auditing

A policy without enforcement is just a suggestion.

  • Technical Enforcement: The best way to enforce a policy is to make violating it technically impossible (e.g., using Group Policy to disable USB drives, rather than just asking employees not to use them).
  • Auditing: Periodically reviewing logs and access rights to ensure policies are being followed. "Trust, but Verify."
  • Sanctions: Policies must explicitly state the consequences of violation, ranging from mandatory retraining to immediate termination and legal action.

The Role of Human Resources (HR)

Information Security is an HR issue as much as an IT issue.

  • Onboarding: Background checks, NDA signing, AUP training, and initial access provisioning.
  • Termination (Offboarding): The most critical phase. When an employee is fired, IT must revoke all access before the employee is notified, to prevent malicious sabotage (Insider Threat).

Introduction to Task 2

When a security incident occurs, management must determine if it was a technical failure, a policy failure, or a malicious act. This dictates the response.

We will analyze a complex policy violation involving an insider threat.

Task 2: Policy Violation Analysis

Timing: 50 minutes

An IT administrator, Alissa, uses her domain admin credentials to access the CEO's email inbox. She reads an email about an upcoming round of layoffs and warns her colleagues on a private WhatsApp group. The CEO finds out.

  1. Alissa argues she was performing a "security audit" of the mail server. Which specific policy document (e.g., AUP, Privilege Access Policy) should HR reference to terminate her?
  2. Identify the technical control failure. How could the organization have technically prevented or immediately alerted on a domain admin reading executive email?
  3. Did Alissa commit a crime under the Computer Misuse Act 1990? Justify your answer.

Summary & Next Steps

  • Policies are the legal and operational bedrock of security. They translate business risk into actionable rules.
  • Standards like ISO 27001 prove to external partners that your security program is mature and managed, not just a collection of firewalls.
Next Week: Information Systems Planning & Administration