Question

Search for security policy templates on the Internet. A good place to start is the SANS Institute www.sans.org. Using one or more of the templates you find, develop a security policy for a business or organization. Provide a description of the business, real or fictional, for which you will be writing the policy. Since there are so many areas of security, focus your policy on three specific areas. Be comprehensive in your coverage of your chosen areas. Do not simply copy another policy, rather customize it to your own organization. Your submission should be no fewer than five pages in length.

Answer 1

Different sections that make this Security Template, and they are as follows:

1. File System : - This is Used to set permissions to access the directories and files on the local system.

2. Account Policies : - These Policies are related with user accounts.

3. Local Policies :- Mainly this Policies deal with who has local access or network access to the computer.

4. System Services : -These System Services include security settings of the system services, such as file, print services on the local computer.

My security template will be constructed as follows:

• Account Policies
  • Enforce Password XXXXX
• 12 passwords remembered (this means that the user cannot use a password XXXXX they have already used in the past 12 password XXXXX)
  • Maximum Password XXXXX
• 90 days (users must change password XXXXX 90 days)
  • Minimum Password XXXXX
• 8 characters (passwords must be at least 8 characters)
  • Passwords must meet complexity requirements
• Enabled (passwords must meet minimum complexity requirements)
  • Account lockout duration
• 30 minutes (If account is locked out due to password XXXXX will remain locked out for 30 minutes, or until manually reset by administrator)
  • Account lockout threshold
• 5 (Maximum number of failed logon attempts before account is locked out)
  • Reset account lockout counter after
• 3 minutes (After 3 minutes a bad password XXXXX XXXXX longer applied to the Account lockout threshold)
• Local Policies
  • Microsoft network server: Amount of idle time required before suspending session
• 20 minutes (Ends server session after 20 minutes idle time)
  • Prevent local guests group from accessing application log
• Enabled (prevents students from accessing/altering application log)
  • Prevent local guests group from accessing security log
• Enabled (prevents students from accessing/altering security log)
  • Prevent local guests group from accessing system log
• Enabled (prevents students from accessing/altering system log)
• System Services
  • GameConsoleService
• Disabled (prevents built-in Games from being shown/accessed)
  • Portable Device Enumerator Service
• Disabled (prevents MP3 players, cameras and other portable devices from functioning with system)
• File System
  • Set to allow users Read and Execute access to most folders on the local hard drive only.