General guidance for creating security plans and agreements - Revision history

Kristin1 at 18:47, 18 June 2024

2024-06-18T18:47:31Z

← Older revision		Revision as of 18:47, 18 June 2024
Line 9:		Line 9:
	** Most security plans will include tactics which aim to prevent identified threats from taking place (i.e. reducing their likelihood). Examples of prevention tactics might include encrypting a database of contacts so as to reduce the likelihood that it can be accessed by adversaries, or employing a security guard at the office so as to reduce the likelihood that it is broken into.		** Most security plans will include tactics which aim to prevent identified threats from taking place (i.e. reducing their likelihood). Examples of prevention tactics might include encrypting a database of contacts so as to reduce the likelihood that it can be accessed by adversaries, or employing a security guard at the office so as to reduce the likelihood that it is broken into.
	** Many of these tactics will reflect strategies of acceptance, deterrence and protection or self-defence. As such, they may include advocacy campaigns or other forms of engagement with the public or civilian and military authorities in order to raise consciousness and acceptance of the legitimacy of our work; strengthening of ties with our allies in order to raise the potential cost of aggressions against us, and any number of tactics which build our own capacities and agility in the face of the threats to our work which we have identified.		** Many of these tactics will reflect strategies of acceptance, deterrence and protection or self-defence. As such, they may include advocacy campaigns or other forms of engagement with the public or civilian and military authorities in order to raise consciousness and acceptance of the legitimacy of our work; strengthening of ties with our allies in order to raise the potential cost of aggressions against us, and any number of tactics which build our own capacities and agility in the face of the threats to our work which we have identified.
	** TOOLS: Devices and information - Devices and information refer to which devices we will depend on in order to carry out our work, and the tactics we will employ in order to ensure that our information and communication can not be accessed by others.		** In this section, consider the following activities:
			*** Identify & assess the threats and your vulnerabilities: This involves systematically analyzing your assets (physically, digitally) to understand potential threats and knowing your vulnerabilities that could be exploited.
			*** Develop security policies and procedures: Create clear policies outlining acceptable behavior regarding physical and digital security, and incident reporting.
			*** Implement preventive measures: based on identified threats, implement safeguards procedures and tools, with considering staff training programs to minimize the potential threats impact.
			*** Invest in Security Awareness Programs: regularly educate your staff/colleagues on the founded security plans and measures, this empowers them to identify, respond and report effectively.
			*** Conduct Security testing: regularly assess the effectiveness of security measures through penetration testing (simulated attacks) and security drills. This helps identify weaknesses and refine procedures.

			** '''TOOLS''': Devices and information - Devices and information refer to which devices we will depend on in order to carry out our work, and the tactics we will employ in order to ensure that our information and communication can not be accessed by others.

	* '''RESPOND: Emergency responses'''		* '''RESPOND: Emergency responses'''
	** Emergency plans, also called contingency plans, are the actions which we take in response to a threat becoming a reality. They generally have the aim of lessening the impact of the event and reducing the likelihood of further harm in its aftermath. Examples of emergency response tactics might include bringing a First Aid kit with you when travelling, in case of minor injuries, or a mask and goggles to a protest in case tear gas is used.		** Emergency plans, also called contingency plans, are the actions which we take in response to a threat becoming a reality. They generally have the aim of lessening the impact of the event and reducing the likelihood of further harm in its aftermath. Examples of emergency response tactics might include bringing a First Aid kit with you when travelling, in case of minor injuries, or a mask and goggles to a protest in case tear gas is used.
	** Coordinating a response to an emergency always involves coordinating actions so digital communication is increasingly important. Decide what the most secure and effective means of communicating with each actor is in different scenarios and identify a back-up means too. Be aware that for emergencies, it might be useful to have clear guidelines on: what to communicate, which channels to use, and to whom.		** Coordinating a response to an emergency always involves coordinating actions so digital communication is increasingly important. Decide what the most secure and effective means of communicating with each actor is in different scenarios and identify a back-up means too. Be aware that for emergencies, it might be useful to have clear guidelines on: what to communicate, which channels to use, and to whom.
			** In this section, consider the following activities:
			*** Build Incident Response Plan: develop a clear plan outlining actions to be taken in case of a security threat. This includes identifying the designated responders, notification procedures (internal teams, authorities), and containment strategies to mitigate impact.
			*** Communication Strategy: Establish a communication plan for internal and external stakeholders during a security incident. This ensures timely and accurate information is disseminated, minimizing confusion and panic.
			*** Business continuity plan: A strategy to ensure critical operations continue with minimal disruption during an incident.
			*** Disaster recovery plan (Data Backups and Recovery): establish a specific plan for recovering IT systems and data, maintain robust data backup and recovery procedures to ensure business continuity in case of after a disaster like a fire, flood, or cyberattack.
			*** Communication and Collaboration: effective communication and collaboration across teams are crucial for successful incident response and recovery.
			*** Train your people: Regularly train staff on security policies, incident reporting procedures, and their roles during a contingency.

	* '''TREAT: Well-being considerations'''		* '''TREAT: Well-being considerations'''
	** Actions we take to maintain our physical energy and a mindful approach to our work and our security –it may include such considerations as where and when we will eat, sleep, relax and enjoy ourselves in the course of our work		** Actions we take to maintain our physical energy and a mindful approach to our work and our security –it may include such considerations as where and when we will eat, sleep, relax and enjoy ourselves in the course of our work
			** In this section, consider the following activities:
			*** Analyze lessons learned: conduct a thorough assessment to understand the cause and scope of the security incidents. This helps identify your vulnerabilities, prevent future occurrences, and establish better prevention plans.
			*** Recovery and Remediation: Implement measures to restore affected systems and data. This might involve patching vulnerabilities in software, restoring lost data from backups, and implementing additional security measures to prevent similar incidents.
			*** Psychological safety considerations, give priority to those affected by incident, and ensure that appropriate care is provided to them if physically or psychologically injured, and treat with causes of the incident accordingly later.
			*** Review and update your security plans and approach: Following an incident, review your security posture and update policies, procedures, and preventative measures based on the lessons learned.

	=== Example of a basic security plan ===		=== Example of a basic security plan ===

Kristin1 at 20:07, 29 May 2024

2024-05-29T20:07:50Z

@@ Line 1: / Line 1: @@
 As far as individual HRDs are concerned, a simple security plan may include the following sections:
-* Objective
+* '''Objective (or activity, region, area of work, etc)'''
 * Threats
-* Prevention - actions and resources
+* '''Threats''' - ideally you will create a security plan for each threat
-* Response - actions and resources
 ** Coordinating a response to an emergency always involves coordinating actions so digital communication is increasingly important. Decide what the most secure and effective means of communicating with each actor is in different scenarios and identify a back-up means too. Be aware that for emergencies, it might be useful to have clear guidelines on: what to communicate, which channels to use, and to whom.
-[https://holistic-security.tacticaltech.org/chapters/strategise/3-5-assessing-organisational-security.html Tips for overcoming resistance to security planning]
+* '''TREAT: Well-being considerations'''
-Sources:
+* [https://holistic-security.tacticaltech.org/chapters/strategise/3-4-security-in-groups-and-organisations.html Holistic Security Manual: Security in groups and organisations]
-* Holistic Security Manual: [https://holistic-security.tacticaltech.org/chapters/strategise/3-3-creating-security-plans-and-agreements.html Chapter 3.3 on Creating Security Plans and Agreements] and [https://holistic-security.tacticaltech.org/chapters/strategise/3-4-security-in-groups-and-organisations.html Chapter 3.4 on Security in Groups and Organizations]
+* [https://holistic-security.tacticaltech.org/chapters/strategise/3-5-assessing-organisational-security.html Tips for overcoming resistance to security planning]

Kristin1 at 13:56, 28 February 2024

2024-02-28T13:56:22Z

← Older revision		Revision as of 13:56, 28 February 2024
Line 9:		Line 9:
	* Well-being considerations		* Well-being considerations
	* Devices and information		* Devices and information

			[https://holistic-security.tacticaltech.org/chapters/strategise/3-5-assessing-organisational-security.html Tips for overcoming resistance to security planning]

Kristin1: Created page with "As far as individual HRDs are concerned, a simple security plan may include the following sections: * Objective * Threats * Prevention - actions and resources * Response - actions and resources ** Coordinating a response to an emergency always involves coordinating actions so digital communication is increasingly important. Decide what the most secure and effective means of communicating with each actor is in different scenarios and identify a back-up means too. Be awar..."

2024-02-28T13:51:52Z

Created page with "As far as individual HRDs are concerned, a simple security plan may include the following sections: * Objective * Threats * Prevention - actions and resources * Response - actions and resources ** Coordinating a response to an emergency always involves coordinating actions so digital communication is increasingly important. Decide what the most secure and effective means of communicating with each actor is in different scenarios and identify a back-up means too. Be awar..."

New page

As far as individual HRDs are concerned, a simple security plan may include the following sections:

* Objective
* Threats
* Prevention - actions and resources
* Response - actions and resources
** Coordinating a response to an emergency always involves coordinating actions so digital communication is increasingly important. Decide what the most secure and effective means of communicating with each actor is in different scenarios and identify a back-up means too. Be aware that for emergencies, it might be useful to have clear guidelines on: what to communicate, which channels to use, and to whom.
* Emergency plan
* Well-being considerations
* Devices and information

Sources:

* Holistic Security Manual: [https://holistic-security.tacticaltech.org/chapters/strategise/3-3-creating-security-plans-and-agreements.html Chapter 3.3 on Creating Security Plans and Agreements] and [https://holistic-security.tacticaltech.org/chapters/strategise/3-4-security-in-groups-and-organisations.html Chapter 3.4 on Security in Groups and Organizations]