Security management — the process

Abstract

This paper gives a view of the organisational infrastructure necessary for the successful implementation of information technology security. Guidance is given on the writing of security policies, the assessment of risks, the realistic appraisal of threats and the selection of countermeasures. All of the mechanisms available can then be put into their proper place within the organisation to achieve the desired security. Moreover, it will be possible to assess the cost-benefit of each element of the security programme in order to decide on the practical compromises to be made.