لطفا منتظر باشید ...
Development Process
All sites should have a comprehensive security plan. This plan should be at a higher level than more specific policies such as the one discussed in the example at the end of this chapter. The security plan should be crafted as a framework of broad guidelines into which specific policies fit. It is important to have this framework in place so that individual policies are consistent with the overall site security architecture. Having a strong policy on corporate access from home but weak restrictions on who is entering the building and using the PC in the lobby is inconsistent with the overall philosophy of strong security restrictions on data access.Social Engineering" in Chapter 2, "Understanding VulnerabilitiesThe Need for Security.")To craft an effective security policy, it is important to appoint a development team. For a security policy to be appropriate and effective, it needs to have the acceptance and support of all levels of employees within the organization. It is important that corporate management fully supports the security policy process; otherwise, there is little chance that the process will have the intended impact. When creating and reviewing a security policy, the following individuals and groups should be involved:
- Site security administrator
- Information technology technical staff
- Administrators of large user groups
- Security incident response team
- Representatives of the user groups affected by the policy
- Responsible management
- Human resources (HR)
