The growth of the Internet and in particular of the World Wide Web presents increasing challenges to information technology and business managers. Whereas networks were once primarily internal, many are now exposed to the Internet. Managers must cope with risks on a daily basis, and many firms lack the resources to allocate their efforts wisely. However, because of the increasing access to networks due to Internet connectivity, threats and vulnerabilities have grown explosively. Today, security must be regarded as a process, not a stable state.
Clients often ask how security analysts evaluate customer security.
These aspects of information security uniquely and completely define what our clients need to protect. However, specific threats and vulnerabilities lead to risks that often involve several of the fundamental imperatives of security. Finally, there are many threats and vulnerabilities that are theoretical or potential rather than realistic or actual. Therefore, security analysts have developed a heuristic framework for discussing the most critical aspects of a customer's information systems architecture and implementation in those areas that are, in our experience, most important and most susceptible to improvement at reasonable cost. We look at security from a number of viewpoints during the evaluation phase.