Lab 12 – Info Sec Management Policy
Description
Background: A high school has asked you to perform a security evaluation. Upon reviewing the IT documentation you realize that there are no written security policies. Further, after interviews, you realize that there has never been any employee training. You decide that this will be the first place to start on helping them revamp the information security strategy of the school. The technology infrastructure is as follows: • All school administrators & support staff have a workstation which is centrally administrated by IT with network logins and a network drive for storage • All teachers have a school laptop (purchased & owned by the school) which is not administrated by IT (due to too many complaints about restrictions) • Many classrooms have workstations or laptops for the students to use in class • The school maintains a wireless network for students with laptops/tablets to use Part 1 Select a policy that the school should have in place based on the above descriptions. You can pick a policy/topic of your choosing, but it should be relevant to the environment. Some choices might be: Use of school technology, network passwords, wireless usage, home use of school technology, etc. Draft a policy that you feel addresses important aspects of security in this environment. Remember, students look for loopholes, so think like a high school student who doesn’t like rules and knows nothing about good technology practices. Not all policies will apply to students, teachers, and administrators. Some topics may require different rules for different groups. You can find sample policies online at: http://www.sans.org/security- resources/policies/ . You may use these as a starting point/template but will need to add/modify to fit the scenario. Part 2 The administration and teachers at the school desperately need security training, but have been doing their own thing for so long they won’t pay attention. Devise a strategy for getting them to pay attention to security training and describe what you would do.
