Network Security Policy is crucial in today's age and having them implemented in organization where you are working is essential. Depending upon the structure of your department. Network security policy should be written by Network Security professional, though it is specific to the organization you are working for but below template will give basic idea of how it has to be written.
Network / Internet Security Policy Template
All users who use the IT Service
(the “employees,” “guests,” “you,” or “your”) of Mairi Manzil Group must
provide a correct user ID and password to access the Network resources, file
server and Internet.
The following are violations of this
agreement:
- Unauthorized copying of data, files and software either belongs to Mairi Manzil Group or any other person’s personal.
- threatening of bodily harm or the threat of property damage to groups or individuals;
- making or taking part in fraudulent offers or products, items or services originating from your account;
- attempting to access accounts of anyone other than your own, attempting to penetrate (“hacking”) security measures of Company, whether or not the intrusion results in data corruption or loss;
- the unauthorized use of a person’s name or likeness;
- Access any other person’s computer or computer system, network, software, or data without his or her knowledge and consent; breach the security of another user or system; or attempt to circumvent the user authentication or security of any host, network, or account. This includes, but is not limited to, accessing data not intended for you, logging into or making use of a server or account you are not expressly authorized to access, or probing the security of other hosts, networks, or accounts without express permission to do so;
- use or distribute tools or devices designed or used for compromising security or whose use is otherwise unauthorized, such as password guessing programs, decoders, password gatherers, keystroke loggers, analyzers, cracking tools, packet sniffers, encryption circumvention devices, or Trojan Horse programs. Unauthorized port scanning is strictly prohibited;
- interfere with computer networking or telecommunications service to any user, host or network, including, without limitation, denial of service attacks, flooding of a network, overloading a service, improper seizing and abusing operator privileges, and attempts to “crash” a host;
- assist others in engaging in prohibited conduct;
- send or receive any material that could be considered harmful, obscene, pornographic, indecent, lewd, violent, abusive, profane, insulting, threatening, tortuous, harassing, hateful or otherwise objectionable without explicit written consent;
Spam Policy
- send “spam,” chain letters, or other unsolicited communications to any party;
- Forward messages.
- posting or emailing of scams or “get rich quick” schemes, pyramid type or chain letters, subscribing others to a mailing list without their prior consent or knowledge or approval;
- disseminate viruses, Trojan horses, or other code or programming intended to damage, interfere with, intercept or expropriate any system, data or personal information;
- Harassing others by “mail-bombs”. Mail bombing is here defined as the sending of more than 10 like messages to the same address or by the sending of more than 10 MB of data to a newsgroup. The sending of unsolicited email messages where the recipient objects to the content of the material sent;
- send or receive any material that harasses, victimizes, degrades, or intimidates an individual or group of individuals on the basis of religion, race, ethnicity, sexual orientation, gender, age, or disability;
- send or receive material containing defamatory, false, or libelous material;
- send or receive any material that you do not have a right to make available under law or contractual or fiduciary relationships;
- Bandwidth Usage
- Streaming is prohibited unless it is official.
- Downloading personal data, video and audio files is not allowed.
- Downloading files more than 20MB (personal or private) is not allowed.
change in policy
ICT Department does not routinely
monitor the activity of individual accounts for violations of this Policy, except
for determining aggregate data consumption in connection with the data
consumption provisions of this Policy. Department has no obligation to
monitor the Service and/or the network. However, Mairi Manzil Group reserve the
right at any time to monitor bandwidth, usage, transmissions, and content in
order to ; identify violations of this Policy; and/or protect the network, the
Service and Company users.
WiFi Security Measures
Though our network has SSID with WPA Encryption, but it doesn't mean the network is well protected we need to ensure access to our network is provided only to Authorized users, therefore any new device to be registered with the Company which will have the following important updates on our System;
- Device Registration : Device's MAC Address to be registered in DHCP Server so the allowed IP range is provided, this depends which VLAN the user will be accessing or the device will only access the Internet, then the mac address to be registered in firewall as well as in Wireless Lan Controller.
- De-Registration : Device to be automatically de-registered from (DHCP, Firewall and Wireless Lan Controller) if device is not seen on network for more than 30 days.
- Login Credentials : All the users of Mari Manzil Group will be provided login credentials to access network resources, SSO is also in place which means that most of the services and resources will be accessed through the same login detail.
BYOD and Company WiFi
Wi-Fi Service is available to only
company provided Devices, however if it is required to use personal Equipment’s
a BYOD policy is applicable and you need to get permission from your HOD to get
the service.
No spamming is allowed. If it is a
marketing related email, only marketing department will be allowed to use email
tool which IT Department can provide, Management has allowed Head Of
Departments to send email to mailing list if it is required to send
everyone you may contact your respective Head of Department, Anyone sending mass mailed
messages to more than 30 recipients will be considered spammers. Spamming is
defined as sending unwanted, unsolicited email to those who have not requested
or invited the message. In no way does Company provide open relaying services
to users not within our network.
Violations of this Policy:
Users need to be aware that the WiFi doesn’t mean internet, when you connect with WiFi it means you are connecting
with company servers and resources and Internet is used for accessing company
emails and other cloud services however if you use internet you need to make
sure that the purpose of Internet is to connect to remote company locations for
example from remote locations to head office and head office internet is to
enable branches to connect with servers, so it is important to take care of
Internet bandwidth as below;
Below techniques will be used to allow
access to network resources
Media Access Controller Address, it
is a unique identified of network interface card of each network device, in
order to get access to network this address should be provided to Department
to add to the list of allowed networks and if device is no more property of
employee they must inform IT to enable them to remove from the list.
Desktops and laptops are already
supplied with USER ID and Password however the BYOD doesn’t have one so it is
important to have user ID and password when accessing Internet and network
resources using WiFi and this user ID and password must not be shared with
anyone to access the network user ID and password needs to be entered and if
device is idle then device will be automatically disconnected.
The policy is specific to Mairi Manzil Group, however, this purely depends on latest threats of the time when you need to write the policy. But the policy Audit is also must, mainly CISSP or CISA professionals will help you to know if policy addresses all the important areas of Network and Internet Security. Most of the companies also write the Security Policy in general that covers Network, Data, Physical, Logical, Computer, Servers, Users and Internet etc. But it totally depends on size of company. You can consider this policy as the subset of overall network security policy.