SunSpot Health Care Provider Remote Access Policy for Remote Workers & Medical Clinics 1.0 Policy Statement It is SunSpot Health Care Provider (SHCP) policy to protect Information Resources based on risk against accidental or unauthorized disclosure, modification, or destruction, and assure the Confidentiality, Integrity, and Availability (CIA) of clinic and patient data. Apply appropriate physical and… Read More »
Hand-Held Device use has become common place in today’s business environment to include company owned assets, and personal “Bring Your Own Device” (BYOD)’s. Security of Hand Held Devices normally spans over many of the other standard domains making it practical to treat them as a separate domain.. The SANS Reading Room article; Security Policy for the use of… Read More »
A Virtual Private Network (VPN) is a group of network hosts that can transfer encrypted data between themselves on a Virtual Private Network. The technology creates a safe encrypted connection, usually over public networks such as the internet, that allows remote users and locations such as branch offices, to securely access and share resources. The main benefit is… Read More »
Basic Principles of Security Awareness. Security experts consider system users the weakest link in information security. User skill levels and experience can greatly vary, and unlike automated controls, human users can be subject to fatigue, or be distracted, which can lead to mistakes resulting in vulnerabilities. Security awareness training is often a user’s first experience with information security.… Read More »
The following is a list of the primary benefits of the COBIT, ISO 27000, and NIST frameworks: COBIT COBIT allows much broader scope and takes into account all IT management processes. Geared towards a method of successfully executing key policies and procedures. It is often used to tie together controls, technical issues and risks, within an organization. COBIT… Read More »
The IT security policy framework is the foundation of an organizations information security program. The framework consists of a library of documents, but is just not a collection of documents. The framework and its documents are used to build an organizations processes, determine appropriate technologies to use, and lay the foundation for policy enforcement. The framework is a… Read More »
Bring Your Own Device (BYOD): Organizations allowing employees to use their own personal devices such as smart phone and tablets to conduct organization business. The SANS Reading Room article, SANS Survey on Mobility/BYOD Security Policies and Practices found that 61% of organizations allowed personal devices to connect to protected company systems, but only 9% of organizations were truly… Read More »
An Acceptable Use Policy (AUP) is an agreement between two or more parties, usually a business or service, and users of an information system. The AUP expresses in writing a policy of certain standards of behavior relating to the proper usage of specific hardware and software services. In other words, it is a set of rules created and… Read More »
When considering the implementation of security policies, an organization must also consider how employee behavior often varies depending on whether the organization uses a flat or hierarchical management structure. In flat organizations, there are less layers between management and employees so decisions and problem solving generally happens faster and at a lower level. Smaller organizations tend to be… Read More »
Threats from within an organization. Insider security threats are the most significant threat to today’s information systems. Insiders often have elevated access within an organizations information systems which often gives them a level of authorized access that can cause a lot of damage if misused intentionally, or unintentionally. In the SANS Reading Room article; Insider Threat Mitigation Guidance,… Read More »