Network Policies and Physical Security Measures

This lesson covers network policies and physical security measures as required by OCR J277 Section 1.4. While technical measures like firewalls and encryption are important, organisational policies and physical safeguards are equally essential for comprehensive security.

---

What Are Network Policies?

A network policy is a set of rules and guidelines that define how a network should be used, managed, and secured within an organisation. Network policies ensure that all users understand their responsibilities and that security measures are consistently applied.

---

Types of Network Policies

1. Acceptable Use Policy (AUP)

An Acceptable Use Policy defines what users are and are not allowed to do on the network.

Typically Permitted	Typically Prohibited
Work-related internet browsing	Downloading pirated software
Using company email for work	Accessing inappropriate websites
Storing work files on network drives	Sharing login credentials
Using approved software	Installing unauthorised software
Accessing authorised resources	Connecting personal devices without approval

2. Password Policy

A password policy sets requirements for creating and managing passwords.

Common requirements include:

• Minimum password length (e.g. 8+ characters)
• Complexity requirements (uppercase, lowercase, numbers, symbols)
• Regular password changes (e.g. every 90 days)
• Password history (cannot reuse recent passwords)
• Account lockout after a set number of failed attempts

3. Backup Policy

A backup policy defines how and when data should be backed up.

Element	Detail
Frequency	How often backups are performed (daily, weekly)
Type	Full, incremental, or differential backups
Storage location	On-site, off-site, or cloud storage
Retention period	How long backups are kept
Testing	Regular testing to ensure backups can be restored

OCR Exam Tip: If asked about backup policies, mention the 3-2-1 rule: 3 copies of data, on 2 different types of storage media, with 1 copy stored off-site. This demonstrates thorough understanding.

4. Disaster Recovery Policy

A disaster recovery policy outlines how an organisation will respond to and recover from a security incident, hardware failure, natural disaster, or other disruption.

Key elements include:

• Recovery Time Objective (RTO) — The maximum acceptable time to restore operations.
• Recovery Point Objective (RPO) — The maximum acceptable amount of data loss (measured in time).
• Roles and responsibilities of staff during recovery.
• Communication procedures (who to contact and how).
• Steps for restoring systems from backups.

---

Access Controls

Access controls determine who can access what resources on a network.

Types of access control:

• User accounts — Each user has a unique account with specific permissions.
• Access levels — Different users have different privileges (e.g. read-only, read-write, admin).
• Principle of least privilege — Users are given only the minimum access rights needed to perform their job.
• Group policies — Permissions are assigned to groups (e.g. "teachers," "students," "IT admins") rather than individual users.

Access Level	Permissions	Example User
Read-only	View files but not modify	Guest user
Read-write	View and modify files	Standard employee
Admin	Full control, including managing other accounts	IT administrator

---

Physical Security Measures

Physical security protects the hardware and infrastructure of a network from theft, damage, or unauthorised physical access.

Key Physical Security Measures

Measure	Purpose
Locked server rooms	Prevents unauthorised access to servers and networking equipment
CCTV cameras	Monitors physical access to sensitive areas and deters intruders
Security guards	Control and monitor physical entry points
Biometric door locks	Restricts access to authorised personnel using fingerprint or iris scans
Keycard/fob access	Electronic access control for doors and restricted areas
Cable locks	Physically secure laptops and equipment to desks
Environmental controls	Fire suppression, climate control, and flood protection for server rooms
Visitor management	Sign-in procedures, badges, and escorts for visitors

OCR Exam Tip: Physical security is often overlooked in exam answers, but it is just as important as technical measures. If a question asks about protecting a network, include at least one physical security measure (e.g. locked server rooms, CCTV) alongside technical measures.

---

User Training and Education

Even the best technical and physical security measures can be undermined by untrained users. Security awareness training should cover:

• Recognising phishing emails and social engineering
• Creating and managing strong passwords
• Reporting suspicious activity
• Following the acceptable use policy
• Physical security practices (locking computers, not tailgating)
• Data handling procedures (especially for personal data under GDPR)

---

Layered Security (Defence in Depth)

No single security measure is sufficient on its own. Organisations use layered security (also called defence in depth), which combines multiple measures:

1. Physical — Locked rooms, CCTV, access cards
2. Technical — Firewalls, encryption, anti-malware, authentication
3. Administrative — Policies, training, access controls, incident response plans

If one layer fails, the other layers continue to provide protection. The diagram below shows how an attacker has to defeat each layer in turn before reaching the data.

flowchart TD
  A[Attacker] --> B["Physical Layer<br/>Locked rooms, CCTV, keycards"]
  B --> C["Perimeter Layer<br/>Firewalls, proxy server"]
  C --> D["Authentication Layer<br/>Passwords, 2FA, biometrics"]
  D --> E["Access Control Layer<br/>Least privilege, user permissions"]
  E --> F["Data Layer<br/>Encryption, backups"]
  F --> G[(Protected Data)]
  style B fill:#fde2e2
  style C fill:#fde2e2
  style D fill:#fde2e2
  style E fill:#fde2e2
  style F fill:#fde2e2

---

Summary

Network policies (acceptable use, password, backup, disaster recovery) and physical security measures (locked rooms, CCTV, biometric access) are essential components of a comprehensive security strategy. Access controls limit who can access what, and user training ensures that people do not inadvertently compromise security. For the OCR J277 exam, remember that effective security requires a layered approach combining technical, physical, and administrative measures.

---

Worked Example: A Case Study in Layered Policy Response