Information Security Policies and Procedures

What is an Information Security Policy?

An information security policy (ISP) is a documented set of rules, guidelines, and

procedures established by an organization to protect its information assets (data, systems,
networks, people).
It outlines the acceptable use, access control, data handling, and responsibilities of
stakeholders to maintain confidentiality, integrity, and availability.

Objectives:

• Protect organizational assets from internal and external threats.

• Define acceptable user behavior and misuse.
• Ensure legal and regulatory compliance (e.g., GDPR, HIPAA).
• Reduce risk through prevention, detection, and corrective actions.

2. Corporate Security Policy Tiers

Information security policies are generally structured in a 3-tier hierarchy.

2.1 Tier 1 — Oganizational or Corporate Information Security Policy

Scope: Entire organization (strategic level)

Characteristics:

• High-level statements of security goals and philosophy.

• Broad responsibility, accountability definitions.
• Applicable to all departments, employees, vendors, and partners.
• Aligns with mission, business strategy, compliance requirements.

Common Components:

• Statement of purpose
• Information security objectives
• Definitions of roles (CISO, IT staff, users)
• Acceptable/unacceptable use
• Risk tolerance
• Legal and regulatory references

Example: “All employees must maintain confidentiality of sensitive data and comply with the
Data Protection Act.”

2.2 Tier 2 — System-specific or Functional (Technical) Policies

Scope: Individual functions, IT systems, or departments.

Characteristics:
 • More detailed than Tier 1.
• Defines specific controls, technologies, and responsibilities.
• Addresses access control, authentication, encryption, auditing.

Examples:

• Password Policy — minimum length, complexity, rotation frequency.

• Network Security Policy — firewall configurations, VLAN segmentation.
• Email/Internet Use Policy — restrictions on file downloads, malware protection.
• Cloud Usage Policy — third-party shared responsibility models.

2.3 Tier 3 — Operational or Procedure Policies

Scope: Task-level implementation procedures.

Characteristics:

• Step-by-step operational instructions.

• Used by IT staff, administrators, incident responders, auditors.
• Highly detailed, regularly updated.

Examples:

• How to onboard a new user account.

• Backup and restore procedures.
• Incident response checklist.
• Patch management workflow.

3. Process Management in Security Policies

Information security is not a one-time deployment; it is an iterative process.

3.1 Key Process Stages

1. Planning and Preparation

• Understand business objectives.

• Identify critical information assets.
• Conduct risk assessment (threats, vulnerabilities, impacts).
• Define policy goals (compliance, audit, risk reduction).

2. Developing Policies

• Map risk assessment results to controls.

• Draft policy documents with scope, goals, responsibilities.
• Consult stakeholders (legal, HR, management).
• Align with standards (ISO 27001, NIST, PCI DSS).
• Ensure readability and minimum ambiguity.

3. Implementation
 • Deploy controls, tools, access policies.
• Train employees.
• Integrate into organizational culture.

4. Monitoring and Review

• Perform regular audits.

• Monitor incidents and violations.
• Update based on:
o Technology changes
o New threats
o Regulatory updates
o Organizational restructuring

4. Asset Classification Policy

Asset classification categorizes information based on value, sensitivity, and risk of disclosure.

4.1 Classification Principles

• Confidentiality: Who can access data?

• Integrity: How critical is accuracy?
• Availability: Is access time-sensitive?
• Impact: What damage occurs if leaked?

4.2 Typical Classification Levels

1. Public
o Safe for open sharing.
o Example: brochures, public reports.
2. Internal / Private
o Limited internal access.
o Example: internal memos, employee directory.
3. Confidential
o Restricted to authorized users.
o Example: financial records, customer data, intellectual property.
4. Highly Confidential / Top Secret
o Strict security controls.
o Example: trade secrets, R&D, source code, national security data.

4.3 Asset Handling Rules

Each level has:

• Access permissions
• Storage guidelines
• Encryption needs (data-at-rest / data-in-transit)
• Disposal procedures
• Backup requirements
5. Developing Security Standards

Standards translate policies into measurable technical requirements.

Examples:

• Password standard: at least 12 characters, 1 special symbol.

• Network standard: enforce AES-256 for VPN.
• Server hardening: disable unused services, enforce MFA.
• Logging & monitoring: SIEM retention for 90 days.

Policy = What to do
Standard = How to do it
Procedure = Step-by-step instructions

6. Cyber-Crime

6.1 Definition

Cyber-crime refers to criminal activities conducted using computers, digital networks, or the
internet to steal, disrupt, extort, or manipulate information and systems.

6.2 Types of Cyber-Crimes

A. Crimes Against Individuals

• Phishing and Social Engineering

• Online harassment and cyberbullying
• Identity theft
• Email spoofing
• Data theft

B. Crimes Against Property

• Hacking into systems

• Ransomware attacks
• Unauthorized digital access (cracking)
• Malware attacks (Trojan, spyware, worms)
• Credit card fraud

C. Crimes Against Organizations

• DDoS / Distributed Denial of Service

• Industrial espionage
• Insider threat
• Intellectual property theft
• Business email compromise

D. Crimes Against Government

 • Cyber terrorism
• Cyber warfare
• Critical infrastructure attacks
• Election interference

7. Digital Evidence

7.1 What is Digital Evidence?

Digital evidence (electronic evidence) consists of any information stored or transmitted in

digital form that can be used in legal investigations.

Examples:

• Hard disk files

• Email logs
• Chat messages
• IP logs
• CCTV digital recordings
• Cloud storage files
• Mobile messages
• GPS data
• Metadata

7.2 Characteristics of Digital Evidence

1. Fragile and Easily Altered

• Can be modified, overwritten, deleted without trace.

2. Reproducible

• Can be perfectly copied without degradation.

3. Time-dependent

• Timestamp, access logs, and metadata are critical.

4. Requires specialized tools and expertise

• For acquisition, preservation, analysis.

8. Nature of Digital Evidence

Volatile vs Non-volatile

Volatile Evidence:

• Lost when power is removed.

• Examples:
 o RAM data
o Active network connections
o Cache
o Running processes
• Must be captured first (live forensics)

Non-volatile Evidence:

• Remains stored.
• Examples:
o Hard drive
o Pen drives
o Cloud data
o Mobile storage
• Easier to preserve but may be encrypted or corrupted.

9. Precautions When Handling Digital Evidence

Digital forensics follows principles of chain of custody and evidence integrity.

9.1 Core Principles (“Forensic 4 Rules”)

1. Do not modify original evidence.

2. Document everything you do.
3. Follow legal and organizational processes.
4. Ensure repeatability and verifiability.

9.2 Best Practices

1. Use Write Blockers

Prevents modification of drive data during acquisition.

2. Create Forensic Images

• Bit-by-bit copy (dd, EnCase)

• Hash-based verification (MD5/SHA)

3. Maintain Chain of Custody

Record:

• Who handled evidence

• When and where
• What actions were taken

4. Preserve timestamps and metadata

• Avoid opening files unnecessarily.

• Avoid booting suspect computers normally.
5. Secure storage

• Locked containers
• Tamper-evident packaging
• Access-controlled forensic labs

6. Follow legal compliance

• Search warrants
• Data privacy regulations
• Jurisdictional laws

9.3 Field Precaution Examples

Computers:

• Do not shut down abruptly—risk losing RAM evidence.

• Disconnect network cables.

Mobile Devices:

• Use Faraday bags to prevent remote wipe.

• Avoid turning off if evidence is volatile.

Cloud & Remote Data:

• Request provider logs.

• Snapshot cloud instances.
• Preserve metadata (API logs, timestamps).

Conclusion

Information security policies form a hierarchical structure:

• Tier 1 (corporate goals),

• Tier 2 (system/technical controls),
• Tier 3 (operational procedures).

They require careful planning, risk assessment, implementation, and continuous review.

Cyber-crimes are evolving in complexity, targeting individuals, organizations, and

government infrastructure.

Digital evidence is unique:

• Fragile
• Easily altered
• Sensitive and time-critical

Proper collection and handling are essential to maintain admissibility in court.

Fundamentals of Information Security

Information Security refers to the practices, technologies, and policies used to protect
information assets from unauthorized access, misuse, disclosure, alteration, or destruction. It
ensures that information remains trustworthy and available for legitimate use.

Core Objectives (CIA Triad)

1. Confidentiality
Ensures information is accessible only to authorized users.
Techniques: Encryption, access control, classification, NDAs.
2. Integrity
Maintains accuracy and completeness of data.
Techniques: Hashing, digital signatures, checksums, audit trails.
3. Availability
Ensures information is accessible when required.
Techniques: Backups, redundancy, Disaster Recovery (DR), high availability systems.

2. Supporting Security Principles

• Authentication – Verifying identity (passwords, biometrics, OTP).

• Authorization – Determining access rights.
• Non-repudiation – Ensuring actions cannot be denied (digital signatures).
• Accountability – Tracking actions of users or systems.
• Privacy – Ensuring personal information is protected.

3. Threats to Information Security

• Malware (virus, trojan, ransomware)

• Insider threats
• Human errors (weak passwords, social engineering)
• Network attacks (DDoS, spoofing)
• Physical theft or damage

4. Approaches to Information Security

• Technical Controls – firewalls, IDS/IPS, encryption.

• Administrative Controls – policies, training, audits.
• Physical Controls – CCTV, locks, smart badges.

Conclusion

Information security is essential to safeguard digital assets. Proper implementation of CIA

triad, supporting principles, and security controls ensures a resilient information environment.

Employee Responsibilities in Information Security

Employees play a critical role in maintaining security because human error is the most
exploited weakness in cyber-attacks.

1. Follow Organizational Policies

Employees must adhere to information security policies such as Acceptable Use Policy
(AUP), password policy, and remote work policy.

2. Password and Account Management

• Use strong passwords and change periodically.

• Never share credentials.
• Enable multi-factor authentication (MFA).

3. Access Control & Least Privilege

Employees should access only the data necessary for their job role.
Unauthorized attempts must be reported.

4. Safe Communication Practices

• Verify sender identity in emails.

• Avoid clicking suspicious links or attachments.
• Use official communication channels.

5. Data Handling

• Handle confidential data according to classification.

• Encrypt sensitive information before transmission.
• Dispose information securely (shred documents, wipe devices).

6. Report Incidents

Employees must immediately report:

• Phishing attempts
• Security breaches
• Device loss or unauthorized access

7. Awareness Training

Participating in regular cyber security training develops skills to identify threats like
malware, social engineering, etc.

Conclusion

Employees are the first line of defense. Their security behavior has direct impact on
organizational cyber-risk.

Information Classification and Handling

Information classification is the process of categorizing information based on value,
confidentiality, and sensitivity to determine protection requirements.

1. Objectives

• Protect sensitive data.

• Enable correct usage and storage.
• Ensure compliance with laws and regulations.

2. Typical Classification Levels

1. Public

• No loss if disclosed.
• Examples: brochures, press releases.

2. Internal / Private

• Limited to employees.
• Example: internal guidelines, memos.

3. Confidential / Sensitive

• Disclosure causes financial or operational damage.

• Examples: customer data, employee records, trade data.

4. Highly Confidential / Restricted

• Critical or strategic data.

• Examples: R&D, top-level financial planning, national security data.

3. Handling Rules

Storage

• Confidential data in encrypted drives or secure servers.

• Access based on role-based authorization.

Transmission

• Use secure channels: HTTPS, VPN, encrypted email.

• Avoid sending passwords or confidential attachments without encryption.

Access

• Follow least privilege principle.

• Multi-factor authentication for critical resources.
Disposal

• Use secure deletion software.

• Shred physical documents.
• Destroy old hard drives or SIM cards.

Conclusion

Classification ensures information is handled exactly as per its sensitivity, reducing risk, and
ensuring compliance.

Answer 4: Tools of Information Security

Tools support policies and reduce vulnerability to cyber threats.

1. Cryptographic Tools

• Encryption: AES, RSA protect confidentiality.

• Hashing: SHA-256 ensures data integrity.
• Digital Signatures / PKI: Prevent repudiation.

2. Network Security Tools

• Firewalls: Control incoming/outgoing traffic.

• IDS/IPS: Detect and prevent network intrusions.
• VPN: Secures remote connections with encryption.

3. Endpoint Protection

• Antivirus/anti-malware to detect malicious code.

• Host-based firewalls.
• Application whitelisting.

4. Access Management Tools

• Role-Based Access Control (RBAC)

• MFA and biometric authentication
• IAM systems (centralized identity control)

5. Monitoring Tools

• SIEM (Security Information and Event Management)

• Log analysis and behavioral detection
• Threat intelligence platforms

Conclusion

Use of security tools is essential for proactive detection, prevention, and enforcement of
organizational controls.
Answer 5: Information Processing and Secure Program Administration

1. Information Processing Controls

Input Controls

• Validate user inputs.

• Check format, range, and type.
• Prevent SQL injection/XSS.

Processing Controls

• Verification rules within software.

• Logging errors and exceptions.

Output Controls

• Mask sensitive information.

• Print restrictions.
• Authorization before viewing reports.

2. Secure System Development

Secure Coding Practices

• Sanitize inputs
• Apply TLS/HTTPS
• Avoid hard-coded passwords
• Use secure libraries

Patch and Configuration Management

• Regular updates.
• Disable unused services.
• Scan vulnerabilities frequently.

Change Management

• Document system updates.

• Review and approval before deployment.

Logging and Auditing

• Monitor access, changes, and failures.

• Maintain log retention policies.

Conclusion
Secure program administration ensures confidentiality, integrity, and availability of systems
from design to operation.

Answer 6: Case Study – Cyber Crimes

A. Harassment via Emails

Description:
Repeated, abusive, or threatening emails sent to intimidate or mentally disturb a victim.

Key characteristics:

• Persistent messaging
• Personal attacks
• Digital blackmail

Evidence:

• Email headers
• IP addresses
• Time stamps and content

Legal action:
Punishable under cyber harassment and e-safety laws.

B. Email Spoofing

Definition:
Sending emails from a forged address to mimic someone else.

Purpose:

• Phishing
• Fraud
• Corporate deception

Example:
Attacker pretends to be a company CEO and requests a money transfer.

Technical Prevention:

• SPF (Sender Policy Framework)

• DKIM (Domain Keys Identified Mail)
• DMARC policies

C. Cyber Pornography (Example: MMS Leak)

Description:
Using digital platforms to share pornographic content without consent.
Methods:

• MMS or video recordings released online

• Adult material involving minors (illegal)
• Revenge porn

Impact:

• Social humiliation
• Psychological trauma
• Criminal charges

D. Cyber Stalking

Description:
Using the internet to follow or threaten individuals.

Behaviors:

• Repeated unwanted messages

• GPS tracking
• Monitoring social media
• Identity impersonation

Victim Impact:

• Fear and anxiety

• Online harassment leading to offline threats