100% excellent job! All requirements were met. Keep up the good work. Professor C

Information Security Fundamentals
Week 3 Security Policies
08 July 2012

Although the sample email use policy is very generic it does outline specific requirements and rules that must be met. The general restrictions are clear, covering prohibited use. It states that the company email system shall not be used for the creation or distribution of any disruptive, offensive, or discriminatory messages. It addresses prohibited emails and emails that need the VP of Operations approval and the consequences for violating the policy.
This email policy does not recognize personal privacy in email, but it allows for a “reasonable amount” of company resources for personal emails. However, this is confusing because it does not define or list the restrictions of personal use. If the business is relatively small than this generalized usage policy would be effective, but for mid to large sized organizations a more in depth email use policy that is part of a larger policy should be developed.
In practice, this sample issue-specific policy would not suffice for the majority, but it is a good basic outline. Organizations that have trade secrets to protect, hospitals, government agencies, and financial institutions would need to dissect this particular policy to identify its strengths and alter its weaknesses. A few of its noticeable weak points are: 1. A formal header – The policy identifies the company and a clear title, but it lacks who’s issuing it, if it applies to everyone or particular departments, an effective date, last revised date, who approved it, a version number, and a classification level 2. The purpose needs better definition – Clearer detailed statements of the policies purpose would make it easier to enforce 3. The scope only references email “sent from” a company email and who it applies to is vague – It should encompass “sent from”, “sent to”, and all entities that use, monitor, or support the companies email systems 4. The prohibited use section does not list the primary use of email first and prohibited use should be better defined 5. The personal use sections is confusing - it contains a prohibited use and restriction statements that should have been put in the “prohibited use” section and it does not define “personal use” 6. The enforcement section is acceptable but there should be a reference to separate disciplinary policy 7. Several sections are missing – Appropriate additions might include, Roles and Responsibilities, Accompanying Policies, and Mobile Email Devices (mobile devices should have a separate policy but they should be referenced in this policy) Policies are the root of any organizations security; confusion can be avoided with the development of clear concise policies.

Referenced Works
Bevis, J., & Chudgar, V. (2007). Writing Effective Policies Part 1: Dissecting an Email Use Policy. Retrieved from Foundstone Strategic Security White Paper: http://www.foundstone.com
Merkow, M., & Breithaupt, J. (2006). Security. In Information Security Principles and Practices (p. 381). Upper Saddle: Pearson Prentice Hall.
SANS Email Use Policy. (2006). Retrieved from SANS: http://www.sans.org/security-resources/policies/internet.php