| 1.3 |  | Security Framework and Policy |
| 1.3.4 |  | The nature and levels of security policies |

| Important aspects of security policies Some important aspects of security policies are as follows:

- Security policies represent trade-offs .

With all security policies, there is some trade-off between user productivity and security measures. The goal of any security design is to provide maximum security with minimum impact on user access and productivity. Some security measures, such as network data encryption, do not restrict access and productivity. On the other hand, cumbersome or unnecessarily redundant verification and authorization systems can frustrate users and prevent access to critical network resources.

- Security policies should be determined by business needs.

Business needs should dictate the security policy. A security policy should not determine how a business operates.

- Security policies are living documents.

Because organizations are constantly subject to change, security policies must be systematically updated to reflect new business directions, technological changes, and resource allocations.

Two levels of security policies
Think of a security policy as having two levels:

1. Requirements level
   At the requirements level, a policy defines the degree to which the network assets must be protected against intrusion or destruction, and also estimates the cost, or consequences, of a security breach. For example, the policy could state that only human resources personnel should be able to access personnel records, or that only IS network administrative personnel should be able to configure the backbone routers. The policy could also address the consequences of a network outage due to sabotage, or the consequences of sensitive information inadvertently being made public.
2. Implementation level
   At the implementation level, a policy defines guidelines to implement the requirements-level policy, using specific technology in a predefined way. For example, the implementation level policy could require access lists to be configured so that only traffic from human resources host computers can access the server containing personnel records.

When creating a policy, always define security requirements before defining security implementations.