Front cover - IBM Redbooks

passwords and will comply with the security policy since its contents will be
understood and the reason for complying will make sense. The trained user will
understand that the policy in place doesn't seek to reduce the user's ability to
work and perform his or her duties, but that it reduces the risk of security
incidents which could definitively prevent the user from perform his or her duties
and could quite likely prevent the company from working properly, if at all.
The training phase is divided into two distinct steps: training the trainer and
training the users. Training the trainer is the first step, of course, because you
have to ensure that someone can explain things to the users. Since the security
infrastructure will be unique for each organization, a custom training curriculum
needs to be designed for the trainer, which explains to that person: the security
infrastructure, the tools used to secure the infrastructure, the scope and
limitations of the tools and of the overall security infrastructure and, perhaps
more importantly, how the trainer should explain everything to the users.
Training the users should then be straightforward, although the trainer will have to
ensure that some of the basics are explained, such as what are threats, what are
attacks (such as social engineering), what the policies and procedures are, and
why it's important to comply with them. If done properly, the training will ensure
that the users are happy with the new security infrastructure and will know
enough to help keep the environment secure – as opposed to being at the top of
the security risk list.
9. Compliance testing
Compliance can be defined as a willingness to abide by rules or regulations. In
order to ensure compliance, the security policy should be enforced, very much
like business rules are enforced. The security policy should also outline, insofar
as compliance testing is concerned, how the rules will be applied, and finally, it
should also outline the measures to be applied to ensure compliance.
Compliance testing will certainly reveal some situations where there is a failure to
comply. In such an event, the security policy should detail the measures that will
be taken to deal with compliance failure, such as the severity of the sanctions,
steps that need to be followed in order to re-establish compliance. Finally, the
policy should provide a feedback mechanism to prevent reoccurrence.
10. Results feedback
Since security is a process and just not a product, it must be understood that it is
based on technology, processes and people; that it evolves over time with the
business; that it also evolves over time with the technology and that, finally, it
evolves over time with changing risks and threats. Thus, as mentioned at the
beginning, it has to be cyclical in nature.
Chapter 2. Security methodologies 93