Like most corporations, a review of our total network perimeter and security policy was in order. A security policy is a well defined document delineating objectives and priorities, identifying critical data assets, controlling access, and identifying what technologies, techniques and resources are available for protecting. A security policy must be specific about mission critical assets and those that are less critical. The policy lists specific operational rules which control access and delineates what vulnerabilities to watch for and how to handle them when they arise. Next, the policy statements must define how to enforce it.
Enforcement means the actions taken to remedy vulnerabilities as they occur.
Although good management of server level security practices have helped prevent compromises, without a good network security policy tailored to particular needs, no network security tool can effectively protect an enterprise. A security policy is not something you can buy off the shelf. Every organization must step up to the challenge and develop a security policy which focuses on its own unique way of doing business. The individual security needs of a campus must be defined reflecting goals and objectives. Once defined, the policy needs to be reliably carried out.