Expert Knowledgebase
Isn't it really all about accounting for your assets, placing a value on each, (assessing the impact to your business if a breach occurs), calculating the risk, (threats, vulnerabilities and likelihood of occurrence), and then implementing security controls to minimize the risks starting with the highest? And to keep doing this as long as your security budget lasts. Oh and then starting over again. ISO 27001:2005 outlines this very approach.
QUESTION POSED ON: 16 OCT 2006
QUESTION ANSWERED BY:
Ed Tittel
How can I argue with somebody who quotes chapter and verse from one of the primary sources of guidance for compliance activity? But, as they say, "the devil is in the details" and indeed I see plenty of infernal influence every time I dig into same.
Related Topics:
Search Advice from more than 250 TechTarget Experts
Your question may have already been answered! Browse or search more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice
ASSOCIATED RSS FEEDS
 |
|
Expert Answer Center: Expert Q&As |
|
View all RSS Feeds | RSS Info
|
|
|
|
|
|
|
| TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of . |
|
| | | |
All Rights Reserved, , TechTarget |
|
|
|
|
|
