Security Policy

A security policy is a form of documentation that is created to enforce certain rules and regulations and keep a structure on procedures. In other words, it is a set of rules that members of a certain organisation must follow as long as they belong to the organisation and have access to their assets and properties. An example of the rules in a security policy would be that "individuals must not use the organization's information assets in an unethical manner."

The security policy comprises of four important steps, security, monitor, test, and improve.

Security
Before we can do anything, we must make sure that the server is secure. This is important since it prevents the organisation's assets from being stolen or exploited. Some technologies that will help us in security includes data encryption and firewall implementations.

Monitor
After securing the network/server, we must monitor to make sure the security policies are not violated. This way, we will ensure that the security policy is being enforced.

Test
To make sure that the network is consistently secure, we must test it to make sure that it is safe from threats. Using technologies like penetration testing and auditing, we can find security  loopholes in the network and fix them and check that the network is in place and safe.

Improve
The security policy must be consistently reviewed to improve, making sure that it is not outdated is still applicable to the organisation.

Source: http://www.windowsecurity.com/articles/Defining_a_Security_Policy.html
             http://408error.blogspot.com/

Common Networking Attacks Threats and Solution

A network attack is defined as a threat or intrusion on a network that will analyse your network and gain information to eventually cause your network to crash or cause it to be corrupted.There are many different types of network threats but the common threats are spoofing, sniffing, mapping, hijacking, Trojans, Denial of Service (DOS) and DDOS and social engineering.

Network devices that are connected to the internet will send IP datagrams, which contains its IP address and application layer data, into the network. "IP Spoofing" is the process of modifying a network device's protocols to replace the source address with a random IP address by taking control of the software running on the network device. This will hide the identity of the source, and makes it difficult to determine where the datagrams come from.

The solution to spoofing is ingress filtering. Routers will usually perform ingress filtering to check the IP address of incoming datagrams, and will check if the source address is reachable via the interface. The router will then drop the datagram if the source address is not within valid range to prevent the device from getting spoofed.

Below is a picture that illustrates how spoofing is done:

Source: http://ayurveda.hubpages.com/hub/Types-of-Network-Attacks