Isn't it really all about accounting for your assets, placing a value on each, (assessing the impact to your business if a breach occurs), calculating the risk, (threats, vulnerabilities and likelihood of occurrence), and then implementing security controls to minimize the risks starting with the highest? And to keep doing this as long as your security budget lasts. Oh and then starting over again. ISO 27001:2005 outlines this very approach.
Requires Free Membership to View
How can I argue with somebody who quotes chapter and verse from one of the primary sources of guidance for compliance activity? But, as they say, "the devil is in the details" and indeed I see plenty of infernal influence every time I dig into same.
This was first published in October 2006