Network Policies

Network policies are the written rules that set out how a network and its users should behave. They do not block an attack on their own; they make sure everyone knows what is expected and what to do when something goes wrong.

What a policy can cover

A typical policy covers four areas:

• Acceptable use – which websites and programs may be used, and whether personal devices or removable storage can be connected.
• Password rules – how long a password must be, how often it changes, and that it must never be shared.
• Access rules – which staff or students may use which systems and files.
• Incident procedure – who to tell, how quickly it must be reported, and what not to do, such as trying to fix the problem yourself.

How policies prevent attacks

Clear expectations help the other prevention methods work. A password is only useful if everyone follows the rule not to share it. User access levels only limit damage if staff ask for the right level instead of borrowing a manager's account. Physical security works better when a policy names the person who holds the key to the room that houses the network switch, and states that every visitor must sign in at reception.

For example, a leisure centre uses a booking network. Its policy says reception staff must lock their screens when they leave the desk, only the manager can change prices, and a lost tablet must be reported to the duty manager straight away. The manager can then disable the account and change the password. The policy has turned passwords, access levels and physical security into everyday habits.

Network policies are not one of the seven common prevention methods, such as firewalls or anti-malware software. They are an organisational measure: they guide people's behaviour so that technical and physical controls are used properly. A rule banning personal USB drives, for example, stops malware spreading from an infected stick, which a firewall would not check.