Security Policy and Operations Life Cycle

This chapter covers the following topics:

• You Can't Buy Network Security
• What Is a Security Policy?
• Security System Development and Operations Overview

A policy is a temporary creed liable to be changed, but while it holds good it has got to be pursued with apostolic zeal.

Mohandas K. Gandhi, letter to the general secretary of the Congress Party, India, March 8, 1922

You do the policy. I'll do the politics.

Dan Quayle, U.S. Vice President (19881992), remark to aide, quoted in International Herald Tribune, Paris, January 13, 1992

Many in security today view security policies as a necessary evil, but what is it about security policies that fills us all (myself included) with dread? Is it the daunting nature of it all? Or is it perhaps the feeling that you are creating paperwork, not solutions? Maybe most of all, is policy viewed as a barrier to installing and playing around with all the cool technology security has to offer?

Depending on the organization, the issue is usually some combination of all three of these. To assuage all of these fears, this chapter presents security policies from a practical perspective. The focus is on why you as the security designer should care about security policies, namely how security policies can make your job easier and your network more secure.

This chapter focuses on describing the high-level process of a security life cycle and the development of a security policy. This will give you foundation knowledge to aid you in developing an overall network security system as discussed in Chapter 1, "Network Security Axioms." Later in this book, Chapter 12, "Designing Your Security System," builds on this information to provide practical guidance once the security policy has been developed and the design team is attempting to architect the security system.

This chapter begins by distinguishing between the right and wrong ways to implement network security. Then it defines what security policies are and explains security policy enforcement issues.

Following this introductory material, the security life cycle is introduced, and the major steps are outlined around the development and implementation of the security policy. Topics in this chapter include the following:

• Business needs Establishing what your organization wants to do with the network and any risks/costs associated with this use
• Risk analysis Assessing potential threats and attacker actions on your network
• Security policy development Defining your overall policies, standards, and guidelines to address your business needs and associated risks with data networking
• Security system development Translating these policies into your overall network security system

Finally, this chapter explains the security system operations life cycle at a high level. This section discusses what to do after the initial deployment of your security system, with a focus on the impact this might have on your security policy. It includes coverage of the following topics:

• System monitoring and maintenance How to keep your systems up and running and be aware of security incidents as they occur
• Compliance checking How to ensure that your security policy is being implemented and that the resulting security system is adequately mitigating attacks
• Incident response Responding to security incidents and gauging their effect on your security system and policies

When you are designing secure networks, it is critical to understand at a high level the events that lead up to the design stage of the security system and the events that follow. This chapter provides an overview of these events and the key elements that make up the policy and operations process.

Rather than try to explain any of these topics in detail, the practical elements of each topic are emphasized, and, at each point in the process, the relationship to security design is emphasized. This chapter is not meant as a replacement for a complete discussion on security policies and operations. That subject could fill several chapters. Because this book is focused on secure network design, this chapter explains only the critical topics and, even then, principally only as they relate to the security design process.