Front cover - IBM Redbooks

so, a security methodology needs to be used and put in place. The goal of this
security methodology is to understand the what, when, where, who, why, and
most importantly, how.
2.5.1 Brief introduction to the methodology
This methodology is not quite as far reaching and complex as the other
methodologies presented in this chapter. The reason behind that is twofold. First,
it is meant to be used as a tool to contextualize important concepts that were
covered in the previous chapter. Second, it is meant to be simple enough that the
concepts contained within it can be understood without getting overwhelmed by
the methodology itself.
That said, this sample methodology is based around three types of activity: 1)
What should I do? 2) How should I build It? and, 3) How should I manage it?
Which translates in the following three words: Assess, Build and Manage. As
shown in Figure 2-17, this is a cyclical process, which is what a good security
methodology should offer.
What Should I do?
How Should I
Manage It?
Assess
Manage Build
How Should I
Build It?
Figure 2-17 The three phases of our sample security methodology
Chapter 2. Security methodologies 87