If security is difficult and hard to manage chances are the approach to security is not logical and consistant. Determine the impact on your organization the system would have if there is a loss of confidentiality, access, and integrity. Do a risk assessment and then determine what needs to be done to mitigate the security risks to an acceptible level. Doing ad hoc fixes, patches, or implementations will get you no where. Take it one step at a time and consider security in all current and future business decisions. Be proactive, not reactive.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/225/25376#25376