1.3 Writing a Security Policy

Security is largely a "people problem." People, not computers, are responsible for implementing security procedures, and people are responsible when security is breached. Therefore, network security is ineffective unless people know their responsibilities. It is important to write a security policy that clearly states what is expected and who it is expected from. A network security policy should define:

The network user's security responsibilities

The policy may require users to change their passwords at certain intervals, to use passwords that meet certain guidelines, or to perform certain checks to see if their accounts have been accessed by someone else. Whatever is expected from users, it is important that it be clearly defined.

The system administrator's security responsibilities

The policy may require that every host use specific security measures, login banner messages, and monitoring and accounting procedures. It might list applications that should not be run on any host attached to the network.

The proper use of network resources

Define who can use network resources, what things they can do, and what things they should not do. If your organization takes the position that email, files, and histories of computer activity are subject to security monitoring, tell the users very clearly that this is the policy.

The actions taken when a security problem is detected

What should be done when a security problem is detected? Who should be notified? It is easy to overlook things during a crisis, so you should have a detailed list of the exact steps that a system administrator, or user, should take when a security breach has been detected. This could be as simple as telling the users to "touch nothing, and call the network security officer." But even these simple actions should be in the policy so that they are readily available.

Connecting to the Internet brings with it certain security responsibilities. RFC 1281, A Guideline for the Secure Operation of the Internet, provides guidance for users and network administrators on how to use the Internet in a secure and responsible manner. Reading this RFC will provide insight into the information that should be in your security policy.

A great deal of thought is necessary to produce a complete network security policy. The outline shown above describes the contents of a network policy document, but if you are personally responsible for writing a policy, you may want more detailed guidance. I also recommend that you read RFC 1244. It is a very good guide for developing a security plan.

Security planning (assessing the threat, assigning security responsibilities, and writing a security policy) is the basic building block of network security, but a plan must be implemented before it can have any effect. In the remainder of this chapter, we'll turn our attention to implementing basic security procedures.

Реферат

In this article the network security is considered. The author states that hosts attached to a network – particularly the worldwide Internet – are exposed to a wider range of security threats than are unconnected hosts. The author emphasizes that that network security reduces the risks of connecting to a network. He stresses that providing network security is a balancing act between open access and security. It is noted that network security generally means providing adequate security on individual host computers, not providing security directly on the network. In this article the author considers security planning which includes assessing the threat, assessing security responsibility and writing of a security policy. The author stresses that developing a network security policy is one of the most important security tasks. The author names and analyzes three distinct types of security threats usually associated with network connectivity:

• Unauthorized access – a break-in by an unauthorized person.

• Disclosure of information – any problem that causes disclosure of valuable or sensitive information to people who should not have access to the information.

• Denial of service – any problem that makes it difficult or impossible for the system to continue performing productive work.

The author states that one approach to network security is to distribute responsibility for, and control over, segments of a large network to small groups within the organization. He considers some means that can be used for providing distributed control, such as using subnets and mailing lists.

In this article writing of a security policy is considered. The author names and describes things that security policy must define:

• The network user’s security responsibilities.

• The system administrator’s security responsibilities.

• The proper use of network resources.

• The actions taken when a security problem is detected.

The author concludes that security planning which includes assessing the threat, assessing security responsibility and writing of a security policy is the basic building block of network security.

Рекомендована література (див. “Список використаної і рекомендованої літератури”):

Основна: 5, 6, 13.

Додаткова: 1, 12.

Питання для самоконтролю:

1. Які види науково-технічного перекладу вам відомі?

2. До якого виду науково-технічного перекладу можна віднести передачу загального змісту тексту?

3. До якого виду науково-технічного перекладу можна віднести розкриття змісту кожного речення?

4. До якого виду науково-технічного перекладу можна віднести передачу відтінків змісту та особливостей стилю?

5. В яких типах англомовних науково-технічних текстів можуть бути відсутні артиклі?

Практичне завдання (виконати письмово):

1. Перекладіть наступні назви журналів:

International Journal of Ethics, American Journal of Education, Science, Discovery, Archeology, Psychological Abstracts, Journal of Aesthetics and Art Criticism, Daedalus, Anthropology, Geographical Review, Focus, American Anthropologist, Journal of Experimental Psychology, American Philosophical Society News, Journal of the American Medical Association, British Historical Review, Perspectives.

2. Виконайте анотований переклад тексту. Виконайте реферування цього тексту.