It addresses the business concerns of management as they pertain to information security. It has been my experience in the security evaluations that I have performed for companies, both large and small, that organizations have a security hot button and have addressed this aspect of security very well and have overlooked other areas. This book takes you through the process of designing an information security program, from evaluating current processes to reviewing incident response procedures, with each section of the book addressing one of these major steps which are required for a complete, cohesive information security program. Inspection is the process of determining the current status and evaluating the appropriate level of security. It is this phase that creates a level of understanding of the issues and the organization's ability to address them.
Protection is the proactive process of creating an environment that is as secure as possible.
This phase examines the ten fundamental aspects of information security and the issues involved. Detection is the reactive process of determining inappropriate activities and alerting responsible individuals. Detection is required for those things that cannot be protected or predicted. Reaction is process of responding to a security incident. This phase focuses on resolving a security incident to minimize the impact.