 |
 |
On Wed, Mar 17, 2004 at 05:30:24PM -0500, STeve Andre' wrote: Hmmm. How can you effectively make a policy for what ports to block or pass? [snip] You can... that *is* the firewall policy. I agree with many of the points you make, but there is a difference between a security policy and a firewall policy. Jim is taking the right approach by developing a security policy first. The security policy itself should be fairly static, because your business needs don't change that much. Using a committee or a board is probably a good thing, because it will be a more precise picture of what your business needs are and shouldn't be dictated by an IT unit/person. sans.org has some good template documents/policies. The security policy isn't going to say what ports to block on your firewall... that's what a firewall policy is. However, a security policy should guide your implementations (security in practice... i.e. anti-virus, perimeter defense including firewalls, account practices, etc.) Implementations are going to be dynamic, often reactions to a new threat, but your security policy should guide the day-to-day decisions (something the IT unit/person does, but then you have backing of your committee/board via your security policy) you make to mitigate those threats. Hope this helps clarify some concepts. Thanks, dpk