A client called me up the other day and asked me to come to his office. Once I arrived, he asked me to install a firewall so that his network would be secure. I asked him for his company’s security policy so I could configure the firewall. He gave me a curious look and asked, “What do I need that for?” In the years since the explosion of the Internet, this response is still the rule rather than the exception. Companies have comprehensive employee policies, sometimes filling two inch binders, but do not have information security policies. If they do, they will hand you 5 sheets of paper that cover the assets of a multimillion-dollar corporation. Just as employment policies describe the practices that employees and managers must take, security policies describe how the company wants to protect its information assets. That is an important concept to remember: Information is an asset. You might not be able to assign it a value, but your competitors might pay thousands or even millions of dollars to understand or even steal those assets.

Information security policies are high-level plans that describe the goals of the procedures. Policies are not guidelines or standards, nor are they procedures or controls. Policies describe security in general terms, not specifics. They provide the blueprints for an overall security program just as a specification defines your next product. Questions always arise when people are told that procedures are not part of policies. Procedures are implementation details. A policy is a statement of the goals to be achieved by procedures. General terms are used to describe security policies so that the policy does not get in the way of the implementation. For example, if the policy specifies a single vendor’s solution for a single sign on, it will limit the company’s ability to use an upgrade or new product. Although your policy documents might require the documentation of your implementation, these implementation notes should not be part of your policy.

Although policies do not discuss how, properly defining what is being protected assures that proper control is implemented. Policies tell you what is being protected and what restrictions should be put on those controls. Although product selection and development cycles are not discussed, policies will help guide in product selection and best practices during development. Implementing these guidelines should lead to a more secure system.

When management participates in the creation of information security policies, it demonstrates that management supports the effort, lending credibility to the entire security program. Having management support is always important. Without leadership, employees will not take policies seriously. Therefore, if you do not have the support of your upper management, your program is doomed to fail before you finish writing the policy.

First you can try to reason with them. You can point out that the systems and data have real costs. You can demonstrate how an outsider or a disgruntled insider can easily access sensitive information that could damage the company’s business functions. You can show them studies, articles, even this book. But if this doesn’t convince them, you might have to wait until your first disaster.

Management might say that everybody is responsible for his or her own security. That might work in the short term, but it prevents the company from working with itself. If one department uses one standard and another department uses another standard, interoperability could be a problem. Policies ensure that the company uses the same standards in every security instance. This consistency makes it easier for the company to integrate, interact with customers, and maintain a sense of security throughout the system.

Finally, an information security policy will help avoid liability. We live in a litigious society. If you try to enforce rules that are not expressly written, you will be sued. If you fire an employee for security violations that have never been written, presented to the employee, or previously enforced, that employee also can sue your company. I know it sounds harsh, but the reality can be devastating when the subpoena arrives.

Have you ever heard about “The 45 Year Plan”?  The first time I heard of it was about a year ago.  I was just getting started in Network Marketing.

It’s about a graph/report that was done by the U.S. government.  I believe it was the Department Of Labor.  I know of many people in the business that show “The 45 Year Plan” to their prospects.

Today I’m going to explain it to you.  This information will blow you away!

Check this out…here’s what the report shows.  This is about your future and mine. 

Most people, about 95% of men and women in this country, work about 45 years of their lives.  Usually, this takes place between the ages of 20-65….give or take.  Most people start working after high school/college, up to the time they retire.

They spend 45 years of their lives at various jobs, or they’re self employed.  Think about that.

These people (the 95%ers) are your families… your relatives…your neighbors…and your co-workers.  I knew I HAD to change and I did!  Do you want to spend so much time working? 

40 hours per week x 50 weeks per year= 2000 hrs./year
(52 weeks in a year…I’m taking out 2 weeks for vacation)
2000 hours x 45 years= 90,000 hours

This means most of us can expect to spend roughly 90,000 hours of our lives working…can you believe that?  Most people just trade time for money…and the cost of living keeps going up 6-10% each year!

And that’s not all.  When these people retire (the 95%ers), they can expect to live on one-half to one-third of their income.  Is that depressing or what?  Don’t be one of them!  I used to be a 95%er, now I’m a 5%er.  Hopefully you’re on the same path.

If you’re not already involved, get involved in Network Marketing.  There is a 2-5 year plan to help someone become job-optional…you won’t have to ‘work’ anymore!  A 2-5 year plan to make more money than you ever have.  A 2-5 year plan to create a REAL residual income!

Remember this equation…”Money + Time= FREEDOM”!