WWW Policies and Email Security Policies

In any modern office, university, or bank, Web Browsing (WWW) and Electronic Mail (Email) are the two most heavily used internet applications—and they are also the #1 entry point for viruses, ransomware, and phishing attacks!

Therefore, every organization develops two critical Issue-Specific Security Policies:

1. WWW (World Wide Web) Security Policy
2. Email Security Policy

Part 1: WWW (World Wide Web) Security Policies

What is a WWW Policy?

A WWW Policy (also called an Internet & Web Browsing Acceptable Use Policy) is a formal set of rules that governs how employees are allowed to use web browsers and the internet on company computers and office Wi-Fi networks, and how the company’s own public website (web server) must be secured.

Why is a WWW Policy Needed?

Without a WWW policy, employees might visit unsafe torrent/gambling websites, download infected .exe files, upload secret company source code to public websites, or waste office bandwidth watching 4K movies.

Key Rules Included in a Corporate WWW Policy:

1. Acceptable Business Use: Company internet is provided primarily for official work and learning. Excessive streaming or gaming during working hours is prohibited.
2. Blocked Website Categories (URL Filtering): Web filters and proxy firewalls automatically block access to malicious, phishing, torrent, pirated software, gambling, and illegal websites.
3. File Download Restrictions: Employees are prohibited from downloading executable programs (.exe, .bat, .msi) or browser extensions without IT department approval.
4. Confidential Data Upload Ban (DLP): Employees must never upload confidential client data, source code, or company financial sheets to public file-sharing sites or unauthorized AI tools.
5. Browser Security & Updates: Automatic browser updates, pop-up blockers, and anti-phishing filters must always remain turned ON.
6. Monitoring Disclosure: The policy clearly notifies employees that all internet traffic on the company network is logged and monitored by the firewall.

Part 2: Email Security Policies

What is an Email Security Policy?

An Email Security Policy is a formal document that defines the rules for using official company email accounts (like [email protected]) to prevent phishing attacks, malware infections, data leaks, and legal liabilities.

Why is an Email Security Policy Needed?

Over 90% of targeted cyber attacks (like Ransomware and Business Email Compromise) start with a single phishing email or malicious attachment opened by an employee! Moreover, an email sent from an official @company.com address is treated as a legal statement by the company.

Key Rules Included in an Email Security Policy:

1. Official Use Only: Company email IDs must not be used to sign up for personal shopping sites, gaming forums, or social media accounts.
2. Prohibition on Auto-Forwarding to Personal Email: Employees must never forward confidential office emails or attachments to their personal @gmail.com or @yahoo.com accounts.
3. Handling Suspicious Attachments & Links: Employees must never click on urgent links asking for password resets or open .exe, .scr, or .vbs attachments. Suspicious emails must be reported using the “Report Phishing” button.
4. Encrypting Sensitive Information: Salaries, Aadhaar/PAN details, passwords, and client contracts must never be sent in plain text; they must be encrypted using S/MIME, PGP, or secure portals.
5. Mandatory Email Disclaimers & Signatures: All outgoing corporate emails must automatically include the official company signature and confidentiality legal disclaimer at the bottom.
6. Email Retention & Backup Policy: Defines how long emails are saved on the server (e.g., 3 to 7 years for tax/legal compliance) before being permanently archived or deleted.

💡 DAVV Exam Preparation Tips

5-Mark / 10-Mark Question: “Explain WWW Policies and Email Security Policies in detail. Why are they essential for an organization?”

• For WWW Policy, divide your answer into Client-Side (Employee Browsing Rules) and Server-Side (Company Website Hosting Rules).
• For Email Security Policy, write the 6 golden rules: Attachment safety, Anti-phishing reporting, Encrypting sensitive data, No forwarding to personal Gmail, Official use only, and Email retention.