Network Security Policy ควรมีอะไรบ้าง
- Known Risks, Recovery Issues, Redundancy
- Contact Info สำหรับรายงานปัญหา Network/System
- Router/Switch Security Policy สำหรับ Production Network
Best Practices สำหรับ Network Security
- เข้าใจ OSI Model
- รู้จัก Network Devices
- Defense Against Network Attacks
- Network Segmentation
- Security Device Placement
- Network Address Translation (NAT)
- Enable Personal Firewall
- Centralized Logging & Immediate Log Analysis
Good Security Policy คืออะไร
قابل تنفيذ (Implementable), ครบถ้วน, ชัดเจน, รายละเอียดเพียงพอสำหรับการปฏิบัติตาม
3 Network Security Management Best Practices
- Formal Information Security Governance
- Stop Data Loss & Insider Threats
- Backup Data, Anti-Social Engineering, User Education/Training
- Clear Policies สำหรับ New Employees/Third Parties
- Update Software/Systems
ทำไมต้องมี Network Security Policy
อธิบาย Security Controls ขององค์กร User Management: Block Malicious Users, Minimize Risky Users
Policies ของ Network Security
Guidelines สำหรับ Access Computer Networks, Policy Enforcement, Design/Implementation ของ Network Security Environment
Key Themes ใน Network Security Policy
- Purpose Statement
- Audience Scope
- Information Security Objectives
- Authorization & Access Control Policy
- Data Classification
- Data Support & Operations
- Security Awareness & Behavior
Network Security Practices คืออะไร
Policies, Processes, Practices ป้องกัน/ตรวจจับ/ติดตาม Unauthorized Access, Misuse, Modification, Denial ของ Network Resources
3 Network Security Management Best Practices (เพิ่มเติม)
- Macro View: Network Security Management
- Micro View: Daily Device Management
- Attack Simulations สำหรับ Contextualized Risk Assessments
- Secure Change Management
Key Components ของ Good Security Policy
- Purpose Statement
- Audience
- Information Security Objectives
- Authority & Access Control Policy
- Data Classification
- Data Services & Operations
- Security Awareness & Responsibilities
- Staff Rights, Responsibilities, Duties
สร้าง Good Security Policy อย่างไร
- Mitigate Inappropriate Use Risks
- Learn From Others
- Legal Compliance
- Risk-Based Security Levels
- Involve Staff in Policy Development
- Employee Training
- Written Policy
- Clear Penalties & Enforcement
Security Policies Examples
- Acceptable Use Policy
- Data Breach Response Policy
- Disaster Recovery Plan
- Business Continuity Plan
- Remote Access Policy
- Access Controls
Simple Security Policy
ระบุ Assets ทั้งหมดและ Threats ทั้งหมด Outline วิธีป้องกันและจัดการเมื่อเกิดเหตุการณ์
Various Security Management Practices
- CIA Triad: Confidentiality, Integrity, Availability
- Privacy Protection
- Password/Identification & Authentication
- Non-repudiation
- Activity Management & Auditing
- Keystroke Monitoring
- Audit Data Protection
- Documentation
