Search your institution's intranet or Web site for its security policies. Do you find an enterprise security policy? What issue-specific security policies can you locate? Are all of these policies issued or coordinated by the same individual or office, or are they scattered throughout the institution? Using the framework presented in this chapter, evaluate the comprehensiveness of each policy you located in Exercise above Which areas are missing?

Search your institution's intranet or Web site for its security policies. Do you find an enterprise security policy? What issue-specific security policies can you locate? Are all of these policies issued or coordinated by the same individual or office, or are they scattered throughout the institution? Using the framework presented in this chapter, evaluate the comprehensiveness of each policy you located in Exercise above Which areas are missing?

Management Of Information Security

6th Edition

ISBN:9781337405713

Author:WHITMAN, Michael.

Publisher:WHITMAN, Michael.

Chapter4: Information Security Policy

Section: Chapter Questions

Problem 2E

See similar textbooks

Similar questions

To learn more about your institution's security rules, look them up on the intranet or website. Is there a corporate security policy somewhere? Where have you come across security rules that are tailored to address a particular problem? What agency or department is in charge of issuing or coordinating all of these policies, or are they dispersed across the organization? Use the framework provided in this chapter to determine whether or not the policies you found in the preceding exercise are complete. What are the omissions in these areas?
Check your institution's intranet or website for security guidelines. Exists a company security policy? Where have you seen security policies adapted to a specific issue? Which agency or department issues or coordinates these policies, or are they dispersed? Use the framework in this chapter to assess the policies discovered in the previous exercise. What are the gaps?
When compared to information security standards, does security policy vary in that it is seen as static or as dynamic evolving? If this scenario is to be determined, what factors need to be considered?
How do security policy and information security standards vary in terms of static or dynamic nature? Do you think anything in particular contributed to the issue's emergence?
In comparison to information security standards, does security policy vary in that it is considered as static or dynamic? Was there anything in particular that might have had a role in causing this situation?
The importance of adhering to established security policies and procedures cannot be overstated. It is necessary to explain why security rules are so critical.
What is the difference between security policy and information security standards in terms of whether they are static or dynamic? Do you think there was anything in particular that contributed to the occurrence of this problem?
How does physical security stack up against other types of security and what precisely do we mean when we speak about it? What are a few of the most important dangers to someone's physical safety that exist today? How do they advertise themselves to the wider public, and what forms do their structural criticisms of the organization take?
How precisely can a security framework help in the planning and implementation of a security infrastructure is something that needs more explanation. The degree to which it diverges from other forms of governance is what sets information security governance apart from those other types. Is there a member of the organization who should be in charge of making preparations for such an event, and if so, who is that person?
The following examples demonstrate how a security framework may be of assistance in the planning and execution of a security infrastructure. Exactly what do we mean when we talk about information security governance, and how does it work? Who inside the organization need to be in charge of making the necessary preparations?
Where do you believe information security begins and ends in a company? The organization's control determines the earliest and latest points at which its security policies and measures become active and inactive, accordingly. Do you think any of these boundaries should be expanded or extended any more? If so, how and why did you go about doing so? If not, what's the cause behind this?
What is the difference between security policy and information security standards? Do you think anything in particular triggered this issue?