Information security policies are high-level plans that describe the goals of the procedures. Policies are not guidelines or standards, nor are they procedures or controls. Policies describe security in general terms, not specifics. They provide the blueprints for an overall security program just as a specification defines your next product. Questions always arise when people are told that procedures are not part of policies. Procedures are implementation details. A policy is a statement of the goals to be achieved by procedures. General terms are used to describe security policies so that the policy does not get in the way of the implementation. For example, if the policy specifies a single vendor’s solution for a single sign on, it will limit the company’s ability to use an upgrade or new product. Although your policy documents might require the documentation of your implementation, these implementation notes should not be part of your policy.

Although policies do not discuss how, properly defining what is being protected assures that proper control is implemented. Policies tell you what is being protected and what restrictions should be put on those controls. Although product selection and development cycles are not discussed, policies will help guide in product selection and best practices during development. Implementing these guidelines should lead to a more secure system.

When management participates in the creation of information security policies, it demonstrates that management supports the effort, lending credibility to the entire security program. Having management support is always important. Without leadership, employees will not take policies seriously. Therefore, if you do not have the support of your upper management, your program is doomed to fail before you finish writing the policy.

First you can try to reason with them. You can point out that the systems and data have real costs. You can demonstrate how an outsider or a disgruntled insider can easily access sensitive information that could damage the company’s business functions. You can show them studies, articles, even this book. But if this doesn’t convince them, you might have to wait until your first disaster.

Management might say that everybody is responsible for his or her own security. That might work in the short term, but it prevents the company from working with itself. If one department uses one standard and another department uses another standard, interoperability could be a problem. Policies ensure that the company uses the same standards in every security instance. This consistency makes it easier for the company to integrate, interact with customers, and maintain a sense of security throughout the system.

Finally, an information security policy will help avoid liability. We live in a litigious society. If you try to enforce rules that are not expressly written, you will be sued. If you fire an employee for security violations that have never been written, presented to the employee, or previously enforced, that employee also can sue your company. I know it sounds harsh, but the reality can be devastating when the subpoena arrives.

Recent Information Security Task is a post from: Geoff Snyder's Leadership and Team Collaboration Blog - Freedom to Think and Dream Big

More From Geoff Snyder

• Need some fun in your workplace?
• A Recent Feedback Lesson
• Chris Brady’s “Rascal Manifesto”

Geoff Snyder Recommends

• The FruitGuys – Changing the World One Apple at a Time (Tomas Carrillo)
• Five Common Home Security Myths to Avoid (Tomas Carrillo)
• Geo-Marketing Security Expectations (Vator News)

It is hard to get good feedback.  The default position in our cultures is: fear.  Fear of honest feedback and probably even more fear of giving it.  Fear of retribution.  Fear of hurting someone’s feelings.  Face it; authorities didn’t used to ask for feedback.  Parents didn’t want to hear it.  Siblings sure as heck didn’t.  Teachers hardly did.  There just aren’t a lot of people who model seeking and giving constructive feedback.  So, in our normal lives at work, people who could be helping us understand how to help them be more effective, and how to lead in ways that work, just don’t tell us.

A Recent Feedback Lesson is a post from: Geoff Snyder's Leadership and Team Collaboration Blog - Freedom to Think and Dream Big

More From Geoff Snyder

• Hi Friend!
• Need some fun in your workplace?
• Who’s Geoff Snyder

Geoff Snyder Recommends

• A New Beginning For Your Dreams (Billy Cox)
• The FruitGuys – Changing the World One Apple at a Time (Tomas Carrillo)
• A Little Bit More (Billy Cox)