A security policy for an organization can be defined as a set of rules, formed to secure a company's intellectual property. A security policy describes data flow limitations and restrictions to access by external sources, such as malicious programs, code files, and data. A security policy is used by the company's staff, IT users, and administrators, and so on. A security policy must be enforced on an organization's network so it helps them to protect the network from potential attack and threats.
The following should be considered before creating a security policy:
- A security policy can be formed to balance access and security, and to minimize risk
- A security policy created should not replace the thoughts of the user
- When a potential threat is identified, a security policy must be created in such a way that it can be changed
Also...