Managing A Network Vulnerability Assessment

Policy Review (Top-Down) Methodology 83

3. System- and application-specific policies. These policies focus on one

specific system or application. As the construction of security architecture

for an organization takes shape, the final element will be the translation

of program and topic-specific policies to the application and system level.

Typical subjects for application-specific policies include:

– E-mail usage

– Internet usage

– Anti-virus programs

The components of a program policy should include:

 Topic. The topic portion of the policy normally defines the goals of the

program. When discussing information, most program policies concentrate

on protecting the confidentiality, integrity, availability, and authenticity of

the information resources. Additionally, ...