2. Chapter 8 – Administering Security  Security Planning  Risk Analysis  Security Policies  Physical Security

3. Security Planning  Policy  Current state – risk analysis  Requirements  Recommended controls  Accountability  Timetable  Continuing attention

4. Security Planning - Policy  Who should be allowed access?  To what system and organizational resources should access be allowed?  What types of access should each user be allowed for each resource?

5. Security Planning - Policy  What are the organization’s goals on security?  Where does the responsibility for security lie?  What is the organization’s commitment to security?

6. OCTAVE Methodology http://www.cert.org/octave/  Identify enterprise knowledge.  Identify operational area knowledge.  Identify staff knowledge.  Establish security requirements.  Map high-priority information assests to information infrastructure.  Perform an infrastructure vulnerability evaluation.  Conduct a multidimensional risk analysis.  Develop a protection strategy.

7. Security Planning – Requirements of the TCSEC  Security Policy – must be an explicit and well- defined security policy enforced by the system.  Every subject must be uniquely and convincingly identified.  Every object must be associated with a label that indicates its security level.  The system must maintain complete, secure records of actions that affect security.  The computing system must contain mechanisms that enforce security.  The mechanisms that implement security must be protected against unauthorized change.

8. Security Planning Team Members  Computer hardware group  System administrators  Systems programmers  Application programmers  Data entry personnel  Physical security personnel  Representative users

9. Security Planning  Assuring Commitment to a Security Plan  Business Continuity Plans Assess Business ImpactAssess Business Impact Develop StrategyDevelop Strategy Develop PlanDevelop Plan  Incident Response Plans Advance PlanningAdvance Planning Response TeamResponse Team After the Incident is ResolvedAfter the Incident is Resolved