This section contains the following topics:
Primary Elements of a Security Policy
Systems Software Security Policy
Applications Software Security Policy
Auditor Function Security Policy
Corporate Level Security Policy
Application Level Security Policy
Detail your security implementation goals before you set out to achieve them. Your installation's CA Top Secret implementation plan should be based on the following premises:
Your environment is not secure immediately after installing CA Top Secret. CA Top Secret is the tool used to build a secure data processing installation.
A security implementation does not go quickly and it requires internal support. Security must have support in terms of management direction, manpower, and resources. Take the time to evaluate the environment and plan the implementation. A rushed implementation often requires rework.
The corporate area assigned to handle security administration is not the only area that needs to be concerned with security and the security product. Security is not a function that can be restricted to one area. It is an environment consisting of every person involved in the data processing function-from the EDP auditors to the end‑users. Without the support of all individuals, it is unlikely that security will be taken seriously within your organization.
The security implementation never ends. After implementation of CA Top Secret, you will find that your use of CA Top Secret must be continually adjusted to reflect changes which occur within your installation. Your implementation is just as dynamic as your data processing environment. It will require continual analysis, review, and modification to properly protect your installation.
Management support is critical during the implementation of security. The proper creation of an attitude throughout your organization that emphatically supports the implementation of security must be encouraged at the highest level. No security software will stop cooperative parties in strategic positions from violating the security software and procedures. Policies must be established that indicate the importance and level of security required for the particular environment. These policies must be communicated to all individuals who use the data processing facilities as part of their job function.
The security policy should address the following areas:
The need for security in your environment.
What is to be protected (for example, data, data processing facilities, hardware).
Who owns the data processing resources (such as data, facilities, and hardware).
Who is responsible to ensure that resources are being accessed, used, or modified in a secure manner.
Who needs access. Requirements might also specify those job functions authorized to determine when an individual requires access to a resource.
How are violations logged and reported.
Action to be taken when security is breached.
In password‑based security systems, this protection could include change intervals, one account per employee, and account assignment for remote users. This approach assumes that:
What is expected of each functional area in the support and enforcement of the policy. Each user of the data processing facility must understand that he has a role to play in the security scheme and must understand what that role is.
Identify those responsible to:
Applications areas must interface properly with the security areas to ensure that application resources are properly protected.
Consider assigning responsibilities to:
The auditors should be responsible for monitoring the effectiveness of the security procedures and controls. Consider assigning responsibilities to them to:
The operations area is responsible for scheduling, controlling, running, and distributing the production processing. Consider assigning responsibilities to them to:
General responsibilities can be assigned to all users regardless of functional area. Consider assigning responsibilities to the general users to:
A corporate level of globally acceptable security measures and procedures is the typical level of policy that is issued for general distribution to all users of the data processing facilities.
There are often applications that require additional measures above the level set by the corporate policy. Specific policies can be developed which detail the additional security requirements necessary for facilities such as accounts payable, human resources, or particularly sensitive facilities. These policies might be distributed to only the necessary functional areas.
|
Copyright © 2010 CA Technologies.
All rights reserved.
|
|