- 2071 Magh · 3 marks
Short note: security policy
Short answer
A security policy is a formal statement of rules defining allowed actions, access control, authentication, data protection, acceptable use, and incident response. It separates policy (what) from mechanisms (how). Discretionary policies let owners decide access; mandatory policies use system-enforced labels. Effective policies are clear, enforceable, and reviewed regularly.
Write a short note on security policy.
A security policy is a formal statement of the rules that describe what is allowed and not allowed in a system with respect to its security. It states which users may access which information and resources, and what actions must be taken to protect them. It is the base for choosing security mechanisms.
Parts of a security policy
- Scope and objectives: what is protected (data, hardware, network) and why.
- Access control rules: who can read, write, execute which objects.
- Authentication rules: password length, expiry, multi-factor use.
- Data protection: backup, encryption, classification (public, internal, confidential).
- Acceptable use: what employees can and cannot do (e.g. no installing unauthorised software).
- Incident response: how attacks are reported and handled.
- Responsibilities and penalties.
Policy vs mechanism
| Policy | Mechanism |
|---|---|
| What should be done | How it is done |
| Set by management | Implemented by the OS (ACL, encryption, firewall) |
| Changes often | Should be general and stable |
Types: discretionary (owners decide access, e.g. UNIX permission bits) and mandatory (system decides by security labels, e.g. military). A good policy is clear, enforceable and reviewed periodically.
✓ Answer checked by Claude Opus 5.5 (high effort)