Security Analysis, Assessment, and Assurance

In the previous chapter, we discussed the important role security policies play in the security of networks, in particular, and in the information communication technology (ICT) infrastructure, in general. The security policy should always be considered as the baseline security piece that dictates what other security mechanism are to be used and how. However, one must not forget that security policies are passive documents; they are lines of statements of what must be done and nothing more. A security policy will not physically stop a determined intruder, for example. To stop a determined intruder, or any other intruder for that matter, the security policy must be put into use. This chapter moves us into a new phase of the implementation of the security policies we discussed in the last chapter, starting with security assessment and analysis.