Interview with Scott Barman, author of "Writing Information Security Policies"
by Mirko Zorz - Thursday, 10 April 2003.
How important are, in your opinion, security policies when it comes to the overall security architecture?

I think that security policies are the most underrated aspect of any information security program. In chapter 1 I write "They provide the blueprints for an overall security program just as a specification defines your next product." How do you tell your administrators to configure a firewall if you don't have a policy to specify what you are protecting? Policies are the foundation for a sound infosec program.

Handheld devices are now owned by many people who use them for business purposes, which makes companies more susceptible to wireless security problems. In your opinion, what is a good approach in writing a wireless and handheld device usage policy to safeguard the corporate network?

Handheld devices, like any new technology, come with a lot of security issues. The first thing I would do is a risk assessment of the device. The risk assessment would look at how the device is used, what its capabilities are, and what are the risks being added to the environment. Once I have that information, I would then look at the proposed mitigations and write a policy that would allow me to mitigate the risks I am unwilling to accept.

For any technology, old or new, this is a good approach to devise a policy. It also allows you to better understand the technology and how it is being used and its effect on information security.

What is, in your opinion, the biggest challenge in protecting information at the enterprise level?

Watching the threat from the insider. Everyone focuses on the attacker from the Internet or what can happen outside of the enterprise. However, statistics continue to show that the biggest threat continues to come from insiders. And sometimes it is a challenge to determine who the insiders are that could cause problems.

The first failure is to not have a proper security awareness program. If the users do not know what is in the infosec policies or what is expected of them as part of that policy, how does the organization expect these users to follow the policy? Unfortunately, most organizations either do not have a security awareness program or have one as part of employee orientation and they do not follow it up with refresher courses.

Having sound policies that understand that the insider is the greater threat, a solid security awareness program, a proactive security enforcement program, and a commitment from management are the keys in meeting this challenge.

What are your future plans? Any exciting new projects?

Not long ago, I contributed a chapter to Que Certification's "CISSP Training Guide." I wrote Chapter 3, Security Management and Practices. I have also been working with the SANS Institute to review some exciting new courses they will be offering. I am also working on a book proposal with a colleague. This should be fun!


Analytics services are tracking users via Chrome extensions

It's quite possible that, despite your belief that the Google Chrome is the safest browser there is and your use of extensions that prevent tracking, your online movements are still being tracked.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Nov 24th