WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

Security policy
A security policy is a guideline for an organization that describes the processes
needed to implement a robust security environment.
There are a number of key principles of a security policy:
► Identify key assets
Identify critical areas of business and those assets that host them. By
identifying those key assets, you can adopt methods that are best for the
environment and create an effective security policy.
► Identify vulnerabilities
Complete a comprehensive assessment of the environment to identify all the
threats and vulnerabilities. Examine each and every area of the environment
to find any way the system can be compromised. It is important to be
thorough. Remember to examine the two types of security: physical and
logical. This can be a resource-intensive activity but it is crucial to the security
of the environment.
► Identify acceptable risk
After completing a vulnerability assessment, the acceptable risk must be
determined. In many instances, this will be a cost issue. To completely secure
an environment would be extremely expensive, so compromises have to be
made to complete the security policy. In most cases, the most cost effective
method to meet the required security level will be used. For example, in a
system that contains mission-critical data for a company, the most advanced
technology available is necessary. However, on a test system with no external
access, the appropriate security level can be met with simpler elements.
► Use layered security model
In complex systems, it is important to have multiple layers of security to
ensure the overall safety of the environment. A layered security model plans
for expected risk and minimizes the impact. It also ensures that all
components are protected, from the user to the back-end data systems, and
that a failure in any one component does not impact the whole environment.
Security configuration
After creating the security policy, you must implement it. Implement steps to
configure the physical and logical security as recommended in the security
policy.
382 WebSphere Application Server V7.0: Concepts, Planning, and Design