Practical UNIX and Internet Security, 3rd Edition

Chapter 3. Policies and Guidelines

Fundamentally, computer security is a series of technical solutions to nontechnical problems. You can spend an unlimited amount of time, money, and effort on computer security, but you will never solve the problem of accidental data loss or intentional disruption of your activities. Given the right set of circumstances—e.g., software bugs, accidents, mistakes, bad luck, bad weather, or a sufficiently motivated and well-equipped attacker—any computer can be compromised, rendered useless, or even totally destroyed.

The job of the security professional is to help organizations decide how much time and money need to be spent on security. Another part of that job is to make sure that organizations have policies, guidelines, and procedures in place so that the money spent is spent well. And finally, the professional needs to audit the system to ensure that the appropriate controls are implemented correctly to achieve the policy’s goals. Thus, practical security is often a question of management and administration more than it is one of technical skill. Consequently, security must be a priority of your organization’s management.

This book divides the process of security planning into five discrete steps:

1. Planning to address your security needs

2. Conducting a risk assessment or adopting best practices

3. Creating policies to reflect your needs

4. Implementing security

5. Performing audit and incident response

This chapter covers security planning, risk assessment, cost-benefit ...