Introduction to Web Graphics Understanding the Basics of Web Graphics

Assessing Risk

• Consider business concerns through the annualized loss expectancy (ALE = SLE * ARO)
• Single loss expectancy (SLE) is equal to the asset’s value times the exposure factor (EF)
• Asset value = TCO + internal value + external value
• EF is the percentage of asset loss that is expected from a particular threat
• Annualized rate of occurrence (ARO) is the estimated frequency with which a particular threat may occur each year

Assessing Risk

• Evaluate existing security controls to determine what controls are deployed and effective
• Leverage existing management and control architecture to build a persuasive business case for, or against, implementing new security controls

Security policy

• At a minimum, an organization’s security policy should cover the following:
• Physical security
• Access Control
• Network security
• System security
• Authorized security tools
• Auditing procedures

Benefits of a Security Policy

• A security policy has the following three important benefits:
• Communicates a common vision for security throughout a company
• Represents a single easy-to-use source of security requirements
• Exists as a flexible document that should be updated at least annually to address new security threats

Inputs for a security policy

• Local laws, regulations and business contracts
• Internal business goals, principles and guidelines
• Security measures deemed essential through risk assessment