How much security is enough?

The CERT Coordination Centre has published a new article which aims to help organisations determine what level of information protection is sufficient and appropriate.

The article recognises that it is not, and never will be, practical to achieve a state of complete organisational security. However it is feasible for an organisation to define a state of ‘adequate security’.

Creating adequate security from an operational standpoint means more than complying with regulations or implementing best practices. Formulating the concept of adequate security helps define the benefit and ideal outcome for security investment and must occur in the context of the security risks to an organisation's mission and objectives.

Read the article

•Date: 7th January 2005 •Region: US/World •Type: Article •Topic: ISM
Rate this article or make a comment - click here