1. IS4550 Security Policies and Implementation
Unit 9
Implementing and Maintaining an IT Security Policy Framework

2. Class Agenda 8/11/16 Lesson Covers Chapter 13 and 14
11/24/2018
Class Agenda 8/11/16
Lesson Covers Chapter 13 and 14
Learning Objectives
Lesson Presentation and Discussions.
Discussion on Assignments.
Discussion on Lab Activities.
Break Times as per School Regulations.
Try to read the text book before class.
(c) ITT Educational Services, Inc.

3. Learning Objective
Describe different issues related to implementing and enforcing information systems security (ISS) policies.

4. Key Concepts Organizational implementation issues for ISS policies
Hindrances to the dissemination of policies and policy monitoring and enforcement strategy
Policy enforcement as it relates to compliance laws
Differences between public and private information technology (IT) security policy implementations
Legal implications of ISS policy enforcement

5. EXPLORE: CONCEPTS

6. Implementation Issues
The key point is to realize that implementation is as much about changing attitudes as it is about implementing controls.
Overcoming perception and changing culture is one goal of security policies.
In other words, it is about implementing in a way that wins hearts and minds.

7. Implementation Issues (Continued)
You achieve this by having a clear and concise plan.
Three common messages to define the need for policies through:
Personal accountability
Directive and enforcement
Being a valuable tool

8. Overcoming Hindrances to Policies
Many different learning levels within an organization
People learn in different ways
Organizational culture plays an important role

9. Overcoming Hindrances to Policies (Continued)
It’s important to remember that success depends on how well the policies are accepted.
Executive management support is critical in overcoming hindrances.
The lack of support makes implementing security policies impossible.

10. Public vs. Private Security Policy Implementation
Public organizations are often bound by legal requirements such as Health Insurance Portability and Accountability Act (HIPPA).
Private organizations implement policies to counter risks affecting them.
Public organizations are almost always larger than private.

11. Public vs. Private Security Policy Implementation (Continued)
Private organizations can quickly implement changes as they are more often smaller than larger public organizations

12. EXPLORE: PROCESS

13. Policy Implementation Strategies
Effective communication is one of the most important best practices to consider.
It’s vital that executive support is obtained early, as without management support, the implementation of security policies is impossible.
Keep expectations realistic, and credibility is built on delivering real solutions.

14. Policy Implementation Strategies (Continued)
Clearly communicate the expected results of the investment in security policies.
Keep the security policies flexible, as security best practice today might be considered obsolete tomorrow.

15. Monitoring and Enforcement Strategies
The information security team should develop a close relationship with the legal team.
Teams should communicate their roles and responsibilities to one another.
The information security team should review the current legislation that governs their business.

16. Monitoring and Enforcement Strategies (Continued)
The legal department should review all new or major changes to policies.
Enforcement of policies is based on a risk assessment, as all policies should be followed.

17. Monitoring and Enforcement Strategies (Continued)
It’s important to ensure that consequence and enforcement is properly socialized throughout organization.
Wherever possible, use automated controls to enforce policies.

18. EXPLORE: ROLES

19. Roles and Responsibilities
Senior Management
Responsible for policy support and funding, along with leadership and governance
Human Resources (HR)
Responsible for policy enforcement regarding employees
IT Management
Responsible for support and leadership for information security also act as change agents

20. Roles and Responsibilities (Continued)
Security Management
Responsible for the overall information security policy creation, implementation, monitoring, and enforcement
Users/Employees
Responsible for following the information security policies, standards, guidelines, and procedures

21. Summary In this presentation, the following were covered:
Policy implementation issues and overcoming hindrances to implementing policies
Policy implementation strategies
Policy monitoring and enforcement strategies
Difference between public and private security policy implementation
Roles and responsibilities associated with implementation and maintenance of an IT security policy framework

22. Unit 9 Assignment
Discussion 9.1 Information Dissemination—How to Educate Employees
Assignment 9.3 Policy Monitoring and Enforcement Strategy

23. Unit 9 Lab Activities
Lab is in the lab manual on line
Lab 9.2 Assess and Audit an Existing IT Security Policy Framework Definition
Reading assignment: Read chapter 13 and 14