Network Security Starts with Workable Policy

If you don't know where you're heading, it doesn't matter which direction you go. Similarly, no security measures will be effective unless you know what you want to protect. All computer security rests on the bedrock of a carefully drawn security policy that delineates what data and systems to protect, what levels of protection are appropriate, and what hardware and software you'll need to do it.

Policy sounds as if it's a high-level concept that doesn't have much to do with day-to-day operations and the nitty-gritty of firewall implementation details. But this is wrong and, what's worse, wrongheaded. Because any firewall system, no matter how it is built, can only implement spec ific decisions that have been made by the organization--as matters of policy.

BBN Internet Services (Cambridge, MA) identifies the "four P's" of Internet security:

-- 
Paranoid
--No Internet connection. Everything is forbidden,
   even perhaps what should be allowed.
-- 
Prudent
--Everything is forbidden except what is explicitly allowed.
-- 
Permissive
--The logical opposite of prudent. Everything is allowed
    except what is explicitly forbidden.
-- 
Promiscuous
--Everything is allowed, including those things that
   ought to be forbidden.

If your organization is like most, you'll find a comfortable spot somewhere in the prudent-to-permissive range and design your security accordingly. You need to determine what will and will not be permitted. Until your organization makes this fundamental decision, it has no workable basis for determining its security needs. The determination process, though, is far from simple and may well vary from departme nt to department within a large organization. The fact is, security is one of those concerns that never really goes away. And in an age of connectivity and internetworking, security is more important than ever (see "Top Security Threats").

Finally, as conditions change, you must be ready to change or revise your policies. Creating your own "Ten Commandments" and engraving them in stone won't work in today's world.