How to Cheat at Managing Information Security

Chapter 2

The Information Security Policy

The purpose of this chapter is to:

■ Review the purpose of the information security policy

■ Relate the policy to security guidelines and baselines

■ Define the information security strategy and a methodology to develop one

Anecdote

Those of you who are kind will enthusiastically remember the early (and might I say ground-breaking) work I did on wireless security. As a result, one day the CEO of a very large insurance company had seen a piece in the Wall Street Journal on my work and demanded that his security manager set up a meeting with me.

Dutifully, off I trotted with one of my staff who always had a copy of Kismet on a Zaurus Linux PDA (war-driving software on a palmtop computer). I explained most of the ...