Section 3 of BS7799 provides guidance on how to classify assets which need to be protected in a way that is useful for defining appropriate security countermeasures. In most organisations there will be a number of assets with different owners and different sets of access privileges. A register of data assets. A designated owner for each data asset. A set of access permissions for each data asset.
Management processes to ensure that access permissions are maintained and enforced.
It is commonplace to note that people are the biggest security risk in any organisation. People can be careless, error-prone and, tragically, downright dishonest at times. Any effective security policy must therefore deal adequately with personnel issues. Companies will need to encourage the development of an inforamtion security culture. Such changes must be introduced gradually with a view to ensuring individuals adopt the new codes of behaviour as a positive response to a real threat to their livelihood and not as a bureaucratic imposition.