This chapter covers the following topics:
- You Can't Buy Network Security
- What Is a Security Policy?
- Security System Development and Operations Overview
A policy is a temporary creed liable to be changed, but while it holds good it has got to be pursued with apostolic zeal.
Mohandas K. Gandhi, letter to the general secretary of the Congress Party, India, March 8, 1922
You do the policy. I'll do the politics.
Dan Quayle, U.S. Vice President (19881992), remark to aide, quoted in International Herald Tribune, Paris, January 13, 1992
Many in security today view security policies as a necessary evil, but what is it about security policies that fills us all (myself included) with dread? Is it the daunting nature of it all? Or is it perhaps the feeling that you are creating paperwork, not solutions? Maybe most of all, is policy viewed as a barrier to installing and playing around with all the cool technology security has to offer?
Depending on the organization, the issue is usually some combination of all three of these. To assuage all of these fears, this chapter presents security policies from a practical perspective. The focus is on why you as the security designer should care about security policies, namely how security policies can make your job easier and your network more secure.
This chapter focuses on describing the high-level process of a security life cycle and the development of a security policy. This will give you foundation knowledge to aid you in developing an overall network security system as discussed in Chapter 1, "Network Security Axioms." Later in this book, Chapter 12, "Designing Your Security System," builds on this information to provide practical guidance once the security policy has been developed and the design team is attempting to architect the security system.
This chapter begins by distinguishing between the right and wrong ways to implement network security. Then it defines what security policies are and explains security policy enforcement issues.
Following this introductory material, the security life cycle is introduced, and the major steps are outlined around the development and implementation of the security policy. Topics in this chapter include the following:
Finally, this chapter explains the security system operations life cycle at a high level. This section discusses what to do after the initial deployment of your security system, with a focus on the impact this might have on your security policy. It includes coverage of the following topics:
When you are designing secure networks, it is critical to understand at a high level the events that lead up to the design stage of the security system and the events that follow. This chapter provides an overview of these events and the key elements that make up the policy and operations process.
Rather than try to explain any of these topics in detail, the practical elements of each topic are emphasized, and, at each point in the process, the relationship to security design is emphasized. This chapter is not meant as a replacement for a complete discussion on security policies and operations. That subject could fill several chapters. Because this book is focused on secure network design, this chapter explains only the critical topics and, even then, principally only as they relate to the security design process.
Part I. Network Security Foundations
Network Security Axioms
Security Policy and Operations Life Cycle
Secure Networking Threats
Network Security Technologies
Part II. Designing Secure Networks
General Design Considerations
Network Security Platform Options and Best Deployment Practices
Common Application Design Considerations
Identity Design Considerations
IPsec VPN Design Considerations
Supporting-Technology Design Considerations
Designing Your Security System
Part III. Secure Network Designs
Edge Security Design
Campus Security Design
Teleworker Security Design
Part IV. Network Management, Case Studies, and Conclusions
Secure Network Management and Network Security Management
Appendix A. Glossary of Terms
Appendix B. Answers to Applied Knowledge Questions
Appendix C. Sample Security Policies
INFOSEC Acceptable Use Policy
Guidelines on Antivirus Process