HP Access Control Client Software manual Components

Designing Access Controls

Comprehensive Security Policy

ness interests, and it is a complex process, encompassing many factors. The more careful you are in addressing each factor, the more effective your security controls will be.

You can also enlist help from the people who will be most affected by your security policy—the users. As described in Chapter 3: “Designing Access Controls,” one option for conducting a needs assessment is to create a committee, with each member representing one group or several groups of users. If you set up such a committee, it should include some members who are managers and some who have no management responsibilities. These committee members can explain their business needs for network access so that your technical solution supports these needs. They can also advise you on what to include in the security policy and how to phrase particular security policies. Finally, they can review the first draft of the comprehensive security policy and make suggestions before you submit it for a more general review.

Several other groups should review the comprehensive security policy. For example, you should ask your company’s legal and human resources depart- ments to review it. You should also ask upper management to approve your security policy. These reviews will ensure that you have covered any legal issues and that your security policies match the company’s guidelines for employees and are incorporated into the instructions new employees receive during training. The endorsement of upper management will have the added benefit of encouraging employees to take the security policy seriously.

When you submit the comprehensive security policy for review, you should set a reasonable deadline for reviewers to return their comments to you. A couple of days before the review is due, send a friendly reminder, informing reviewers of the impending deadline.

You may need two sets of reviews if you receive a lot of review comments. Implement the comments from the first review and send an updated copy to reviewers.

The Components

There is no set format or template for writing a comprehensive security policy. You can use the format that meets the needs of your company. To view some examples, search for security policies in your favorite Internet search engine. Some organizations, such as universities, publish their security policies online. You might also find it helpful to review the SANS Institute’s guidelines for writing a comprehensive security policy (http://www.sans.org/resources/ policies/).

3-6