Fundamentals of Information Systems Security, 4th Edition

Compliance

An organization’s security policy sets the tone for the way you approach security activities and states the rules with which you must comply. Think of a security policy in terms of traffic laws, whose purpose is to maintain a certain degree of order and safety on the roads, but only if they are enforced; otherwise, the roads can become dangerous. Likewise, an information security policy must be enforced to be effective in protecting assets. When policies are enforced, the organization complies with them. Three primary means are used to ensure compliance:

• Event logs

• Compliance liaison

• Remediation

Event Logs

Event logs are records of actions that an organization’s operating system or application software creates, showing which user ...