Security Policy
From Chapter 4, Understanding the Cybersecurity Kill Chain, to Chapter 9, Privilege Escalation, we covered attack strategies, and how the Red Team could enhance an organization’s security posture by leveraging common attack techniques. Now it is time to switch gears and start looking at things from an exclusively defensive perspective. There is no other way to start talking about defense strategies other than by starting with security policies. A good set of security policies is essential to ensure that the entire company follows a well-defined set of ground rules that will help to safeguard its data and systems.
In this chapter, we are going to cover the following topics:
- Reviewing your security policy
- Educating the end user
- Policy enforcement
- Monitoring for compliance
Let’s start by highlighting the importance of reviewing your security policy, and the best ways to go about this task.
