Which of the following should be included in the information security strategy?

Security threats are unfortunately a routine part of doing business. In 2019, an organization fell prey to ransomware once every 14 seconds. Your company requires a rigorous, comprehensive information security policy to deal with these concerns. As you craft your policy, though, you'll need to include the right core elements to give it the clarity, authority, and scope it requires to be effective.

We're here to help. This article covers the critical elements of an information security policy and highlights some best practices for information security policies and procedures to help your business attain its data security goals.

What is an information security policy?

An information security policy, sometimes known as a cybersecurity policy or data security policy, is a set of rules and procedures that keeps an organization's data secure. A business usually designs its information security policies to ensure its users and networks meet the minimum criteria for information technology (IT) security and data protection security.

All users on all networks and IT infrastructure throughout an organization must abide by this policy. If not, the organization's data could be vulnerable to attack. Generally, the policy applies to all of an organization's digital data and covers the following areas of security:

• Data
• Facilities
• Infrastructure
• Networks
• Programs
• Systems
• Third and fourth parties
• Users

A good information security policy accomplishes numerous objectives:

• Defining an overall organizational approach to organizational security
• Laying out user access control policies and security measures
• Detecting compromised assets such as data, networks, computers, devices, and applications
• Minimizing the adverse impacts of any compromised assets
• Protecting an organization's reputation for information security
• Complying with applicable legal requirements from standards and regulatory bodies such as the Family Educational Rights and Privacy Act (FERPA), the Health Insurance Portability and Accountability Act (HIPAA), the National Institute of Standards and Technology (NIST), and the European Union's General Data Protection Regulation (GDPR)
• Protecting sensitive client data such as protected health information (PHI), personally identifying information (PII), and credit card numbers
• Establishing frameworks through which to respond to questions and complaints about cybersecurity threats such as malware, ransomware, and phishing
• Limiting access to information to users with a legitimate need for it

For best results, an organization's information security policy should be both practical and enforceable. At the same time, it should also be flexible enough to accommodate the needs of various departments and levels in your business.

The importance of an information security policy

An information security policy is indispensable for any business that needs to handle sensitive customer data responsibly and earn client trust. There are a few reasons it’s so critical in conducting business today.

First, an information security policy helps protect against malicious threats. Security incidents such as data leaks and data breaches quickly erode consumer confidence. A good information security policy helps prevent these incidents and keeps client trust high. It also reduces the risk of substantial financial losses — $8.19 million, on average — associated with cyberattacks.

Proper information security planning is also critical for protecting highly sensitive data. Not all information in the business world is created equal. Exceptionally sensitive data that could cause tremendous losses if leaked, along with intellectual property and personally identifying information, requires a higher level of protection than other types of data. An information security policy gives your business a defined way to prioritize and secure these types of data.

Another significant benefit of an information security policy involves minimizing vendor risk. Many companies outsource services to third- and fourth-party vendors, widening the circle of individuals who have access to critical data. An information security plan can help a business clarify how to manage its vendor risk and keep the shared information as secure as possible.

If your organization is just getting started with your information security policy, you may want to break the policy down into discrete, manageable chunks. You can develop one at a time, polishing each one and leaving open the option to add new information as you think of it. Even if this isn't your first time developing such a policy, you'll still want to be sure you have the cornerstones in place.

Here are eight critical elements of an information security policy:

1. Purpose

The first essential component of an information security policy is a defined purpose. Broadly, the purpose of your information security policy is to protect your company's essential digital information. However, your business will likely want to define your policy's goals in a more focused and actionable way. The purpose of your information security policy might be any one or a combination of the following objectives:

• Clarifying your approach to organizational information security
• Creating a template for information security throughout your organization
• Forestalling the compromise of your organization's sensitive information
• Detecting information security breaches caused by misuse of data, networks, computer systems, or applications or by improper third-party use
• Responding to information security breaches swiftly and effectively
• Upholding your brand reputation in data security
• Complying with legal, regulatory, and ethical requirements
• Respecting customer rights to the privacy of their personal data
• Bolstering your ability to respond to consumer inquiries about data protection, security requirements, and your company's compliance in these areas

An organization that fails to articulate a clear, concrete purpose for its information security policy runs the risk that its security measures will be unfocused and ineffective. On the other hand, defining a clear purpose for your company's information security policy enables you to tailor your security measures to provide enhanced data protection.

2. Audience and scope

The next essential element of your information security policy is its audience and scope. Be sure your business specifies the reach of its policy — that is, which users the policy will apply to and which it will not apply to.

For instance, a business might decide that it will not include third-party vendors in its information security policy. It might determine that, though an extended reach may seem tempting for security purposes, its policies will be much easier to manage and enforce if it limits them to its own organization.

In general, though, it's best not to limit the scope of your information security policy in this way, even if you are not legally obligated to protect the data you share with third parties. Allowing your third- and fourth-party vendors to operate outside the rules of your information security policy opens your business up to a substantial risk of security breaches and data compromise.

One reason to make the scope of your information security policy as broad as you can is that your customers don't necessarily understand the difference between your internal employees and your third- and fourth-party vendors. If a security breach occurs with one of your vendors, your clients may become frustrated and lose confidence in your company's ability to keep their confidential information secure. Your reputation may suffer as a result. Including third- and fourth-party vendors under the broad umbrella of your company's information security policy, on the other hand, lets you keep a tighter hold on client data and maintain customer trust.

Another aspect of scope to consider is what infrastructure your policy will govern. Ideally, your information security policy will cover all programs, data, facilities, systems, and other technological infrastructure within your organization. This broad scope of coverage also helps your policy reduce your company's data security risks.

3. Information security objectives

You will want to consider your company's information security objectives as you craft a data security policy. The IT industry generally recognizes three main principles, often known as the CIA triad, of information security policies:

• Confidentiality: An information security policy should keep sensitive information assets confidential, and only authorized users should have access to protected information
• Integrity: An information security policy should preserve data in a complete, accurate, and fully intact form, and the data should be operational within your IT infrastructure
• Availability: An information security policy should also ensure that IT systems are available to authorized users when necessary — the data should be available continuously and reliably

An alternative strategy is to use the Parkerian hexad, developed by Donn B. Parker, a leading IT security expert. This hexad includes three new principles in addition to the traditional principles of confidentiality, integrity, and availability:

Possession: Possession, or control, refers to the physical location of the medium that stores an organization's sensitive information. Say that an organization keeps encrypted files containing secure information on tapes. The encryption means the tapes comply with the requirement for confidentiality, but if the tapes become lost or otherwise leave the company's possession, that loss still represents a security risk.

Authenticity: Authenticity refers to transparency about the origins of sensitive information. For instance, an email doctored to look like it’s come from a different user violates the principle of authenticity. Digital signatures are one way to bolster authenticity.

Utility: Utility denotes how useful the data is in practice. The information protected under your information security policy must still be usable — encrypted data, for instance, should not be so encrypted that no one in your organization can access it.

4. Authority and access control policy

An information security policy should also indicate what members of your organization have the authority to limit access to data. These people should be trustworthy employees with enough data security insights to make correct decisions about what information is shareable and what is not.

The extent of permissible data sharing may not be entirely your company's decision to make. For instance, a healthcare company will need to comply with HIPAA requirements that limit disclosures of patient information.

Your organization's hierarchy plays a key role in access control. Lower-level employees likely do not have the insights or authority to grant access to others, so they should generally avoid sharing the data they have access to. Higher-level managers and executives with more comprehensive insights into the company's overall function have usually earned the right to grant access to information as they see fit.

Your information security policy should contain an access control policy that clarifies who in your business may authorize information sharing. This section should define the amount of authority every position in your company has over information and IT systems. It should also clarify how to manage sensitive data, what access controls the company has, who has authority over those controls, and what minimum security standards the company must meet.

Your business must also have sufficient controls to allow authorized access and deny unauthorized access. Common access controls include measures such as:

• Strong password requirements
• Frequent password updates
• ID cards
• Access tokens
• Biometric measures such as fingerprint access devices

Consider implementing monitoring systems that capture login attempts, including the identity of the user attempting to gain access, the time and date of the login attempt, and whether the attempt succeeded or failed. You should also have a system for detecting remote login attempts and a strategy for retracting terminated employees' access promptly.

5. Data classification

Data classification is an essential element of your information security policy. You'll want to classify your data by security level — for instance, by assigning it to categories such as "public," "confidential," "secret," and "top secret." You could also break down your data in a hierarchy as follows:

• Level 1: Information available to the public
• Level 2: Information that is meant to remain confidential but would not cause serious harm if it became public
• Level 3: Information that could potentially cause harm to your company or your clients if it became public
• Level 4: Information that could potentially cause serious harm to your company or your clients if it became public
• Level 5: Information that would undoubtedly cause serious harm to your company or your clients if it became public

Under these systems, every level of non-public data would require some form of protection, with higher tiers requiring more stringent security.

You will likely also want to acknowledge in your data classification what information the law protects and what information it does not protect. Public information, of course, receives no legal protection. You may also designate some data as confidential if the law does not protect it but your company believes it deserves protection anyway. Additionally, you might designate some information as high-risk data if it requires protection under the law.

Examples of high-risk, legally protected data include the following:

• Healthcare information protected under HIPAA
• Educational information protected under FERPA
• Financial information
• Payroll information

As your company defines its data classifications, it should also lay out the measures necessary to protect the data to the required level.

6. Data support and operations

Data support and operations include the measures your company will implement for handling each level of classified data. These are the three primary categories of data support operations:

Data protection regulations: Your business must put organizational standards in place to protect personally identifiable information and other sensitive data. These standards must align with any applicable industry compliance standards and local or federal regulations. Most security standards and regulations require at least a firewall, data encryption, and malware protection.

Data backup requirements: Your organization will also need to generate secure data backups. Encrypt your backups and be sure to store the backup media securely. Storing your backup data securely in the cloud is a highly secure option.

Movement of data: Your business should ensure data security whenever it moves its data. Be sure you transfer your data over secure protocols and encrypt any information you copy to portable devices or transmit via unsecured networks.

7. Security awareness and behavior

Your organization will need to implement strategies to heighten its security awareness and prevent breaches. It may need to encourage specific employee behaviors to bolster that awareness and thwart attacks and losses.

One of the best ways to accomplish this goal is to train your staff members thoroughly on your information security policies. Be sure your staff becomes familiar and comfortable with your sensitive data classification system, data protection strategies, and access protection measures.

These are a few components you should include in your security training to boost security awareness and promote responsible behavior:

Social engineering: Educate employees about the risks associated with socially engineered attacks such as  phishing emails. Give your employees sufficient training to detect, thwart, and prevent attacks like these, and make them responsible for doing so consistently.

A clean-desk policy: One of the easiest ways to prevent data losses is to keep sensitive data out of sight and out of reach. Consider implementing a company-wide clean-desk policy to accomplish this goal. Instruct your staff members to keep unsecured items off their desktops and work areas. Strategies include filing or shredding old papers, removing printouts promptly from printer areas, and securing laptops to work areas using cable locks.

Internet use policy: Consider implementing stringent internet use policies as well. Depending on your data's sensitivity and your workplace's requirements, you may wish to block information-sharing websites such as YouTube, Facebook, and other social media sites. You can use a proxy to block unauthorized website access and keep your data secure.

8. Responsibilities, rights, and duties of personnel

The final component of your information security policy should outline your staff members' rights, responsibilities, and duties regarding data protection. Give your employees responsibility by designating certain individuals to perform access reviews, educate other employees, oversee change management protocols, handle incidents, and provide general oversight and implementation support for your information security policy.

Be sure to define personnel responsibilities and duties clearly, and inform your employees of what rights and authorizations they have. Doing so will help your organization avoid data management errors that could pose security risks.

Best practices for drafting information security policies

Here are a few best practices to follow as you develop your organization's information security policies:

Make your policy a living document: Your information security policy should be flexible enough to accommodate technological advances and other changes within your organization. Update it as necessary to address new threats and challenges.

Coordinate between departments: Make sure all your company's departments are on the same page in terms of information security. Your administrative staff, for instance, should communicate frequently with your IT department to coordinate risk assessment and ensure regulatory compliance.

Develop a security incident response plan: Your information security policy contains a wealth of information designed to prevent security incidents. You should also develop and implement a robust security incident response plan so you can handle breaches responsibly if they do occur.

Develop acceptable use policies: Acceptable use policies lay out how your organization should use its resources. They help prevent data breaches from occurring through misuse of company resources, such as if employees take home laptops without approval or help unauthorized individuals gain network access.

Comply with privacy regulations: Regulations such as the GDPR and U.S. federal laws such as HIPAA and FERPA protect the privacy of an organization's end users. Be sure you research the laws that apply to your business and maintain compliance with them.

Learn more about security and compliance from Box

The Content Cloud enables you to share information, collaborate, and power critical workflows throughout your business, all while ensuring rigorous levels of security. Our enterprise-grade security and compliance management solutions help you prevent data breaches by using intelligent threat detection and classification-based security controls. You'll be able to keep information safe and assure your clients their sensitive data is secure.

Our advanced security product, Box Shield, provides native classification across file types and multiple built-in and inline DLP and DRM controls optimized for frictionless UX. Admins can create policies to enforce classification-based security controls on external collaboration, shared links, downloads across web/mobile/desktop, and restrictions for third-party apps, printing, and FTP.

Threat-detection policies use native machine-learning-powered detection and alerts on insider threats including anomalous user behavior. Built-in malware protection warns the user and prevents the spread of malware by restricting download and local editing, while allowing preview and online editing with Microsoft 365 and Apple iWork.

Try Box today, or contact us to learn more about using Box to enhance your information security policy.

**While we maintain our steadfast commitment to offering products and services with best-in-class privacy, security, and compliance, the information provided in this blogpost is not intended to constitute legal advice. We strongly encourage prospective and current customers to perform their own due diligence when assessing compliance with applicable laws.