Intro To Cybersecurity
(CYSE 300) Prof. Quinn
Short Paper #2
Corporate Security Policy
To design a security policy for a corporate information system consisting of on-premises web, application, and database servers every aspect of the policy should be role-based and highly detailed. It would be best to divide the policy into five sections and discuss the five most important issues to focus on so that the company can be able to thrive. Being that the database servers store very sensitive data that must be highly protected, we must enforce security and also implement multiple layers of security.
The first emphasis that must be addressed in this corporate security policy is Authentication. Implementing authentication such as multi-factor security authentication is critical especially when dealing with sensitive data because this serves as a layer of security that verifies credentials and ensures that the data is being accessed by the correct individual. Authentication methods such as multi-factor prove to be useful because most vulnerabilities happen when credentials are weak and session tokens are overtaken by hackers.
The second level of security emphasis in the corporate policy is about Access Control. Controlling what an individual can access is critical because this establishes roles and makes it easier to monitor sensitive areas. Using role based access enforces the distinction of duties so there will not be an overflow of individuals in a single role. Using role based access is also beneficial because this way it is easier to note who has access to sensitive information and note those who might be responsible in the case of intrusion or a social engineering attempt.
Since this corporate security policy is dealing with highly sensitive information it is important to promise Data Protection. Following the framework of the CIA triad it is critical to implement Confidentiality, Integrity, and Availability because if the data is compromised, leaked, changed, or if systems are down when needed, the organization can suffer the legal consequences. In this policy, all sensitive data stored should be encrypted and stored securely limiting its access. This policy will also ensure that there are tools in place that can detect any and all changes to the information being dealt with and also all changes made must be signed off on. Lastly, all data must be backed up and replicated and it is critical to ensure all backups are also encrypted.
The network system that handles this database’s servers must also be highly secured and configured. Hardening the network limits the exposure of the network making it less visible to lurking attackers and less prone to vulnerabilities. Firewalls must be also implemented to deal with network traffic and to block any unauthorized access attempts should the network be exposed.
End to end encryption is critical in this policy and will be used for communication. Any and all communication in this database must be encrypted as a measure of security. End-to-end encryption will serve as a layer of security because if any employees were to discuss sensitive information, such as sharing passwords, access codes, or the type of information being stored, then these conversations will be encrypted and make it difficult for any lurking attackers to view.
The last emphasis of security is to audit and monitor all security measures for efficiency and vulnerability purposes. All log-in attempts successful and unsuccessful must be logged by the digital security team. It is important to log the successful attempts because this can be used to measure efficiency and the organization can get the feel for what works and the features that are beneficial to the organization’s security. Keeping a log of unsuccessful log-in attempts can be used to understand a breakdown in security and the security team can monitor all suspicious activities.
References
Digital Policy Office. (2025, September). Securing web application. InfoSec. Retrieved September 11, 2025,
InfoSec: Securing Web Application
Fortinet. (2025). What is firewall configuration and why is it important? Fortinet. Retrieved September 11, 2025, https://www.fortinet.com/resources/cyberglossary/firewall-configuration#:~:text=A%20firewall%20plays%20a%20vital,maximum%20protection%20against%20a%20cyberattack
HackerOne. (n.d.). OWASP Top 10 web app security risks. HackerOne. Retrieved September 11, 2025,
OWASP Top 10 Web App Security Risks | HackerOne
Oracle. (n.d.). Introduction to Oracle Database Security. In Oracle Database 2 Day + Security Guide (11g Release 2). Oracle. Retrieved [9/11/2025]