Security Policy Development and Deployment: a Case Study

The diploma thesis describes the development and deployment of three security policies for a company with more than thousand employees and several locations throughout Slovenia. The thesis begins with a detailed description of the company's environment and the perception of security – related problems. After that, the fundamental characteristics of information security and security policies are reviewed. A special focus is given on the meaning of effectiveness and deployment of security policies in a company’s practice. In this sense, the possible reasons and consequences of an unsuccessful deployment are also presented, followed by a review of two international standards dealing with security policies. In the last part of the thesis, the core ideas of proposed security policies are explained together with their relation to existing documentation in the company. Additionally, we include a short discussion on more restrictive rules, which would probably make the policy less efficient. A step by step description of the necessary activities for deploying the security policies and additions to the existing documentation is given at the end