Security Policies Vs. Security Procedures
June 16, 2015 Patrick Botz
|
It seems that many people don’t understand the difference between security policies and procedures. When I ask to see a customer’s security policy, if I get anything, it is usually documentation about how system security values should be set. Once in a while it contains a description about how certain tasks will be accomplished. For example, updating applications on the production system. While this kind of documentation is useful, it is not a security policy. In short, security policy identifies acceptable and/or unacceptable uses of various business assets. Importantly, security policy shouldn’t include descriptions of how to enforce, prevent, or |
