Wireless and Mobile Device Security, 2nd Edition

IT Security Management

IT security management involves several related activities. These may be performed as part of a cycle of repeating security processes, depending on the organization’s size and complexity. Security practices and policies should be appropriate for the size and value of the network and its assets. They should be cost-effective and in proportion to the value of what you wish to protect. The first step, then, logically requires identifying the assets needing protection, as well as their relative value and importance to the company. Subsequently, you must identify the threats to those assets and the possible consequences of those threats.

Methodology

There are two methods for performing a risk assessment:

• Quantitative assessment ...