Security policies

Security policies are essential to preserve the proper functioning of a company, since they protect the workers and the equipment used.
This applies, for example, to an IT company, which has to guarantee the security of digital data, just as a farm has to preserve the health of its crops.

In both cases, security policies serve to analyse in advance the possible problems that could arise during the employees' work and try to prevent malfunctions and errors, avoiding possible losses.
The security policy for information, personal data and digital preservation aims to protect information resources from all threats, whether organisational or technological, internal or external, accidental or intentional, guaranteeing confidentiality, integrity and availability, in compliance with current legislation.

The information security policy is implemented to protect, as far as possible and in any case at an optimal level and at a cost compatible with the specific features of the company, the information and privacy management system from events such as threats or incidents, external and/or internal, objective and/or subjective, that can compromise the delivery of services.

For example, in IT, security policies cover several aspects, such as training the staff who have to work with the systems, so that they don't cause damage, and data backup, to prevent an event outside the company's control from causing the loss of more or less important information. Finally, they include a set of rules to follow to avoid human error and, in case of error, the procedures to adopt.

The recovery plan

The recovery plan is divided into four phases:

1. Prevention

Acting before the damage happens, equipping yourself with adequate firewalls and monitoring systems and trying to anticipate possible malfunctions or attacks.

2. Detection

Constantly monitoring the situation to identify problems before they happen, or while they are happening, so as to limit the damage.

3. Response

When an attack is under way, it can be blocked, for example by acting on the malicious traffic or by taking the servers offline.

4. Recovery

This phase involves restoring all the functions of the system. Regular backups and recovery procedures are needed to get back up and running as quickly as possible.

This text was originally written for a class assignment in the 4th year of secondary school, on 20 October 2021