IT Security Policy Plan for Small Business Networks

Project Overview and Purpose

Because small corporations often operate under conditions of conflicting information technology demands, maintaining these systems involves many time-consuming processes. A well-organized approach to IT management allows a business to operate logically and supports more sound business decision-making, with the end result being organizational progress and consistent profitability. The absence of an IT Security Policy Plan can therefore prevent an organization from reaching its full potential.

This project's main objective is to design a network security plan for implementation and to detail the process of putting that plan into practice. The purpose is to address the various aspects of having a written and enforceable technology security policy, while also describing an overview of the necessary components for an effective policy to remain functional. The intention is to provide enough detail for any reader of this policy to gain the necessary understanding of the underlying processes, methodologies, and procedures needed to initiate the development of a system-wide IT Security Policy for a small corporation.

This project proposal defines a viable IT Security Policy Plan for any small business network with thirty computers or fewer and three or fewer servers, operating a range of services that includes traffic from web-based applications, email, and an application database. The email system for smaller organizations will require continual security upgrades based on risk factors, as the current lack of email security affects overall system performance.

This policy has the objective of identifying all necessary detailed policies and procedures, rules, and process methodologies that everyone who uses or accesses the organizational computer resources must adhere to. Doing so will ensure more reliable confidentiality, integrity, and availability of the organization's data and resources. The main advantage of this process is that it documents an organization's security posture, describes and assigns functions and responsibilities, grants authority to security professionals, and identifies which incident response processes and procedures must be followed.

Defense-in-Depth Security Framework

It must be understood that all security-related decisions made — or failed to be made — determine how secure or insecure the organizational network will be. The functionality of the organization's network provides insight into how easy or difficult the network will be to use. Part of this implementation process also takes into consideration the organization's security objectives and goals, making effective use of all security tools so that administrators can check for any new restrictions to impose.

Security and ease of use are inversely proportional. There will never be a 100% completely secure system. The underlying objective is to reduce as much risk as possible while not bogging down system resources. Network security carries the challenging responsibility of protecting all members of the organization from all potential threats. Consider the responsibility borne by organizations such as banks, financial institutions, insurance companies, brokerage houses, consulting and governmental contractors, hospitals, medical facilities, laboratories, internet and television service providers, utility and chemical companies, and universities. Security takes on new meanings in each of these contexts because of each industry's unique requirements.

When developing an IT Security Policy Plan, it is important to keep in mind the defense-in-depth model, which holds that a company should not be overly reliant on any single means of protection. Instead, this design takes into consideration the development of a security program capable of providing multiple layers of defense in order to ensure a maximum level of protection for the organization's data and resources, while minimizing the potential for data compromise.

Review of Network Security Challenges

As any policy creator should expect, an IT Security Policy Plan can only protect data from known or existing information-compromising processes or exploits. All organizations' network data and systems are potential targets for hazardous exploits; however, with an effective Information Technology Security Policy Plan, the network administrator should be able to effectively detect both blatant and subtle anomalies in current or future network traffic. The organization will therefore have the ability to take proper steps toward mitigating potential problems — in other words, implementing a proactive rather than reactive security posture.

Network security for both internet-facing and internal networked infrastructures is required to seamlessly deliver three main objectives. In the small business environment, the basic security concepts of confidentiality, integrity, and availability must all be met. IT Security Policy Plans have historically allowed organizations to address these needs by clarifying processes of authentication, authorization, and nonrepudiation. Other networking plans may or may not address these needs, because network security means different things to different organizations. For example, one administrator may consider illegal network access to be a disruption to computer communication systems similar to the large-scale attacks perpetrated on major internet companies, while another administrator may define the problem as the execution of a covertly placed spybot. In each case, the solution would require a completely different response based on the administrator's interpretation.

It is critical to understand the significance of work in the area of network security. There have been instances of high school students with poor academic records successfully gaining unauthorized access to highly secured network infrastructures at the Department of Defense, the Department of Transportation, and other sensitive environments. These individuals understand the underlying concepts of network security well, having grown up immersed in networking technology. Add the threat of sophisticated hackers, professional terrorists, and even state-sponsored actors seeking competitive advantage, and the concept of network intrusion takes on far greater complexity.

Administrators must be aware of the wide range of techniques used to breach network security, including probes, scans, account compromise, root compromise, packet sniffers, denial-of-service attacks, exploitation of system trust, malicious code implementations, and many other internet infrastructure attacks. Of course, in the majority of cases the real threat to network security is not a sophisticated hacker — it is typically an ordinary employee who uses an insecure password or forgets to log off at the end of the day. A viable IT Security Policy Plan provides a network security engineer with the proper tools to address all of these concerns. Protecting organizational intellectual property is a key objective, and the proper institution of an IT Security Policy Plan is therefore mission critical.