Front cover - IBM Redbooks

88 Lotus Security Handbook
The three phases can be broken down further into ten steps, as illustrated in
Figure 2-18. The details about each step are explained in the remainder of this
chapter.
Assess
Build
Manage
2.5.2 Phase 1: Assess
1. Know the
Business
2. Threat
Analysis
3. Risk
Analysis
4. Categorize
the Data
5. Policies and
Procedures
6. Countermeasures
7. Implement
& Create Docs
8. User
Training
9. Compliance
Testing
10. Results
Feedback
Figure 2-18 The ten steps of the ISSL methodology
What is the Customer's Business?
Who Would Attack, What are the Impacts?
What Exactly Needs to be Secured?
How Sensitive is the Information?
What are the Policies and Procedures?
How can Risks be Controlled or Prevented?
How can this be Implemented and Documented?
Do Users Know How to be Secure?
Is Everything in Place Compliant?
How are Things? Can They Be Improved?
The first phase is where all the planning takes place. The activities in this phase
involve both the evaluation of the current state of affairs and the planning of the
security infrastructure to be put in place. Following is a detailed breakdown of the
security-related activities that need to be performed during the assessment
phase.
1. Understand the business of the client
In this activity, we ensure that a solid understanding of the business of the client
organization is developed. To determine the proper security mechanisms to put
in place, you first must understand some basic things about the organization,
such as the core business, the stakeholders, the demographics of the business,
the vendors, the business partners (if any), the competition and the industry