Front cover - IBM Redbooks

2.5.3 Phase 2: Build
4. Categorize the information
Not all information needs to be secured in the same manner. Public information
doesn't need to be secured, while “top secret” information (whose disclosure to
unauthorized parties could result in the death of the business, or worse, the
death of people) needs the utmost security and attention. Most information falls
somewhere between these two extremes. Determining where each piece of
information should be classified within these extremes, and what security to
apply to each category of information, is done in this phase.
5. Define policies and procedures
This is where the security policy is crafted for the business. The security policy
contains all the organization policies and procedures in matters of security.
In most organizations, if there is a security policy, it is generally crafted from
existing, non-IT policies and procedures that were defined for the business, then
overlaid with information about the IT infrastructure and its security tools and
work. This piecemeal approach explains why the security at these organizations
is lacking.
In the ISSL methodology, security policy is based on the work that was
conducted in the previous steps. If the previous steps were not done properly,
the security policy will definitively be lacking. Even if the previous steps were
done properly and attention was paid to details, additional questions need to be
asked at this step, namely: What systems are covered and who will be affected?
How will security be implemented and maintained? What will be secured, how,
and with what tools? Who will be trained to ensure secure behaviors?
As well, the security policy should have the full support and full endorsement of
the highest executive in the organization. The security policy should detail who is
responsible for security within the organization, with roles and responsibilities
being defined from the top down, starting with the organization's executives, then
to the security manager, then to the owners of the different processes in the
organization, then to the developers, engineers, and administrators of the IT
infrastructure, all the way down to the individual users, who generally, in matters
of security, are the chief troublemakers.
The activities in this phase involve the actual implementation of the security
infrastructure. All of the studying, evaluation, and classifying has been done. The
security policy has been built and ratified by management. It's now time for
action. The following steps make up the build phase.
Chapter 2. Security methodologies 91