To create a secure computer environment, you bring together the pieces of the puzzle. This documents outlines the steps you need to take to create a secure environment, thereby, solving the security puzzle. Other pages on this site will further help you achieve this goal. The starting point for all security issues is policy. Establishing a security policy entails knowing what to do, why you're doing it, and then, finally, how you're going to accomplish it.
Policy starts at the top.
Your organization should have a very clear and simple policy statement about why you do security. That helps us to derive lower level policies about what you're going to secure, what we're going to invest in security and how we're going to approach security. These policies eventually become embedded in the different products that we install and in the different mechanisms that we put in place in order to enforce security. Another important piece of the policy discussion is training. Security policy doesn't exist in a vacuum.