27
Developing a pre-installation security plan
Educating users
Educating users
Your overall site policy involves a numbers of tasks. Of these, user education is critical
.
Publish your
company’s security policy. Make sure that your users are informed of the determination of would-be
invaders and the sophistication of available password guessing programs. Make sure that they understand
how common security breaches are and how costly they can be. These facts alone dictate that users should
be encouraged to select passwords that are difficult to crack and to change passwords regularly.
Involving the user community
When developing the details of your security plan, you should solicit the input of group managers or
leaders on what services they require, for what users, and so on. Explain to users the need for network
security to protect private information, intellectual property, and your business plans.
Notifying affected users
Before implementing policies, notify the user community of your proposed policies. Doing so in advance
can prevent unnecessary frustration on the part of your users.
For instance, if you plan to pass all email through a dedicated server, or if external users will be disallowed
from accessing certain systems by Telnet, consider passing these changes along before implementation.
Consulting users prior to implementation may save you the time needed to fine-tune those policies later.
Taking a pro-active stance
Again, keep in mind that configuring a set of authorization rules on the security gateway is just one piece of
your overall security plan. To be effective, this plan should also include:
■
Physical security of key systems (especially the security gateway)
■
Security risk training for users
■
Guidelines on passwords
■
Proprietary information policies
■
Network planning
Filling out worksheets
Use the following set of policy planning worksheets to aid in the planning process. Use these worksheets to
help implement the specific tasks of your security plan and to assist you during the installation process.
Defining your organization
Begin by defining your organization. Here is where you explore your existing security policy, if any. Note
who will be assigned as administrators, types of authentication, and how your administrators will be
contacted.
To define your existing organization
1
Does your organization have a security policy?
If you checked No, refer to the first part of this appendix for information relating to the development of
a security policy.
2
Number of users behind your security gateway: _____
_____ Yes
_____ No
