Managing A Network Vulnerability Assessment

81

Chapter 5

Policy Review (Top-Down)

Methodology

The cornerstones of effective information security programs are well-written

policy statements. This is the wellspring of all other directives, standards,

procedures, guidelines, and other supporting documents. As with any assess-

ment process, it is important to ensure that policies establish the direction

management wants to go with regard to security. The top-down portion of

the network vulnerability assessment (NVA) looks at the policies requested in

the Pre-NVA Checklist (see Appendix B).

The top-down review will assess policies in two ways:

1. Do they exist?

2. If so, how good is the content?

This ...