Browse by Tags

Security Basics - Overview of the Security Program

The framework around which administrative, technical, and physical controls are built is the security program. This article walks through building a program, including policies. (This article is updated content from the book, "Just Enough Security.")

Security Administrative Controls - Part 1

Access controls prevent unauthorized people from viewing or stealing information assets and employees from accessing sensitive information and systems not required for day-to-day tasks. They fall into three general categories: administrative, logical (technical), and physical. This is the first in a series of articles that examines preventive administrative...

Security Basics - User Awareness

User awareness is an essential part of information security. The existence of policies, standards, and guidelines must be known to the employees that handle your data and manage your infrastructure. This article explores the basics of user awareness training. (This article is updated content from the book, "Just Enough Security.")

Security Basics - Standards, Guidelines, Procedures and Baselines

Policies state management intent and define security outcomes. Standards, guidelines, procedures, and baselines from the operational framework for achieving those outcomes. In this article, we define these security framework elements and their relationship to policies. (This article is updated content from the book, "Just Enough Security.")

Security Basics - Components of Security Policies

Policies are the heart of a security program. They are management's statement of support and expected outcomes from security controls. In this article, we examine the various components of a policy. (This article is updated content from the book, "Just Enough Security.")

Information Security Primer - Part 4

In this final installment of the Information Security Primer series, we'll examine some fundamentals of risk management, specifically the components of a sound security program. The proper application of risk management principles provides the framework upon which managers base the reasonable and appropriate application of security controls.