Security Policy: A Range of Options

To build a security system, one needs to know what is being protected. These could be devices such as servers, routers, and modem banks and information such as e-mail, intellectual property, trade secrets, customer lists, business plans, and medical records. Sometimes, the information has to be protected by law. One also needs an idea of who this material is being protected from: hackers, customers, insiders (employees and contractors), competitors. From this one can do a simple risk analysis to determine what is at risk data or the network and the level of countermeasures required to solve the problem.

In risk management one can either ignore, accept, defend, or pass on a problem. Unfortunately, there is no canned security policy that you can obtain or use. Each business has its own unique requirements and practices that dictate how implementations are made. Table 7.2 shows varying levels of security, the configuration, what is secured by the configuration, and in what applications such a configuration might be used.