---
title: "Short note: security policy"
subject: "Operating System"
chapter: 8
key: "semester_6/operating_system:security-policy-note"
source: https://www.bctengineer.com/q/semester_6/operating_system/security-policy-note
site: BCT Engineering
---

# Short note: security policy

Operating System · Chapter 8: Security

- Asked in: 2071 Magh, 3 marks
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_6/operating_system/security-policy-note
- Whole chapter: https://www.bctengineer.com/md/semester_6/operating_system/chapter-8

## Question

Write a short note on security policy.

## Short answer

A security policy is a formal statement of rules defining allowed actions, access control, authentication, data protection, acceptable use, and incident response. It separates policy (what) from mechanisms (how). Discretionary policies let owners decide access; mandatory policies use system-enforced labels. Effective policies are clear, enforceable, and reviewed regularly.

## Answer

A **security policy** is a formal statement of the rules that describe what is allowed and not allowed in a system with respect to its security. It states which users may access which information and resources, and what actions must be taken to protect them. It is the base for choosing security mechanisms.

#### Parts of a security policy
- **Scope and objectives:** what is protected (data, hardware, network) and why.
- **Access control rules:** who can read, write, execute which objects.
- **Authentication rules:** password length, expiry, multi-factor use.
- **Data protection:** backup, encryption, classification (public, internal, confidential).
- **Acceptable use:** what employees can and cannot do (e.g. no installing unauthorised software).
- **Incident response:** how attacks are reported and handled.
- **Responsibilities and penalties.**

#### Policy vs mechanism
| Policy | Mechanism |
|---|---|
| What should be done | How it is done |
| Set by management | Implemented by the OS (ACL, encryption, firewall) |
| Changes often | Should be general and stable |

Types: *discretionary* (owners decide access, e.g. UNIX permission bits) and *mandatory* (system decides by security labels, e.g. military). A good policy is clear, enforceable and reviewed periodically.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. What is a security policy?
   A. A tool that encrypts data
   B. A formal statement of what is and is not allowed regarding security
   C. A program that detects viruses
   D. A hardware lock
   Answer: B. It is the base for choosing mechanisms. (Key point: Policy)

2. Which is correct?
   A. Policy is how; mechanism is what
   B. Both are set by users
   C. Policy is what should be done, set by management; mechanism is how, implemented by the OS
   D. Mechanism changes often, policy never
   Answer: C. ACLs, encryption and firewalls are mechanisms. (Key point: Policy vs mechanism)

3. What decides access in a mandatory policy?
   A. The owner of the object
   B. Each user's choice
   C. The size of the file
   D. The system, using security labels
   Answer: D. In discretionary policy owners decide, e.g. UNIX permission bits. (Key point: DAC vs MAC)