Information Security Policy

Author: Blane Warrene

Businesses that do not have clearly written Information Technology security policies and practices in place run the risk of being named in legal actions in the very near future. Although no current court cases exist, many security experts are warning that if you lose or expose confidential business or customer data, unknowingly distribute viruses or experience a breach of your systems that results in loss of service to your customers, you could be found liable. Computer and network security used to be the concern of only the largest corporations. Now, however, with the high availability of networks, web hosting and Internet applications to even the smallest office, the tide is turning. Today, a small business with two employees can construct an economical network, share a cable modem and purchase a firewall, which enables remote access using a Virtual Private Network (VPN). This is also a double-edged sword. This new "high availability" has also born a vast breed of crackers.* These individuals can find ways to access, steal and/or destroy data residing on public and private networks. Starting th Process The key to establishing these policies and practices is to not be overwhelmed by the complexity of the process. Start by taking inventory of your systems, connections to the Internet and external providers, the method in which you store data and the method in which you secure and backup data. During this documentation process, you can identify clear procedures for the handling and transfer of this data, as well as new security measures you can use to show due diligence in addressing any potential security risks. The Basics Even the smallest network should adhere to the following: