Summary

In this chapter we took a detailed look at security as a process. First, we took a look at analyzing risk by presenting quantitative and qualitative methods including an exercise to understand the approach. We moved on to getting security expectations documented and the power to enforce them by developing policies and standards. Applying these items to use cases provides the data needed to build the enterprise trust models. When policies and standards cannot be met, we have exceptions to track deviations and develop a remediation plan. We noted that if the same exceptions are raised consistently, a review of the policy or standard might be required. Lastly, we covered when to involve the security team in the change management process for review and approval of change requests and properly documenting the review. The overall goal of security is to be integrated into business processes, so it is truly a part of the business and not an expensive afterthought simply there to patch a...