Front cover - IBM Redbooks

trends and standards in which the organization operates. This will establish a
solid foundation upon which to do the rest of the security work.
The overall security review process can be divided into the following distinct
steps:
1. Review the current state of the business
a. Identify the core business
b. Identify the stakeholders
c. Compile the demographics of the business
d. Identify the vendors
e. Identify any business partners
f. Identify the competition
g. Identify the industry trends and standards
2. Perform an initial infrastructure review
a. Review the infrastructure from a hardware point of view
b. Review the infrastructure from a software point of view
3. Perform an initial risk analysis (a more detailed one follows in a later step)
4. Review the security policy if there is one
a. Policy goals and objectives
b. Scope
c. Responsibilities
d. Physical security
e. Network security
f. Data classification
g. Access control
h. Password policies and procedures
i. Incident handling procedures
j. Acceptable use policies
k. Change control
l. Training
m. Compliance
Once this is done and reviewed, you can move on to the next steps outlined by
this sample methodology. The IT people working for the organization whose
Chapter 2. Security methodologies 89