Kết quả đánh giá Sau khi tất cả các thông tin thu thập được hoàn thành, nhóm nghiên cứu đánh giá nhu cầu để phân tích các thông tin. Một đánh giá của các an ninh của một tổ chức không thể lấy mảnh duy nhất của thông tin như thể chúng tồn tại trong chân không. Nhóm nghiên cứu phải xem xét tất cả các lỗ hổng bảo mật trong bối cảnh của tổ chức | 104 Network Security A Beginner s Guide Assessment Results After all information gathering is completed the assessment team needs to analyze the information. An evaluation of the security of an organization cannot take single pieces of information as if they existed in a vacuum. The team must examine all security vulnerabilities in the context of the organization. Not all vulnerabilities will translate into risks. Some vulnerabilities will be covered by some other control that will prevent the exploitation of the vulnerability. Once the analysis is complete the assessment team should have and be able to present a complete set of risks and recommendations to the organization. The risks should be presented in order from biggest to smallest. For each risk the team should present potential cost in terms of money time resources reputation and lost business. Each risk should also be accompanied by a recommendation to manage the risk. The final step in the assessment is the development of a security plan. The organization must determine if the results of the assessment are a true representation of the state of security and how best to deal with it. Resources must be allocated and schedules must be created. It should be noted that the plan might not address the most grievous risk first. Other issues such as budget and resources may not allow this to occur. POLICY Policies and procedures are generally the next step following an assessment. Policies and procedures define the expected state of security for the organization and will also define the work to be performed during implementation. Without policy there is no plan upon which an organization can design and implement an effective information security program. At a minimum the following policies and procedures should be created Information Policy Identifies the sensitivity of information and how sensitive information should be handled stored transmitted and destroyed. This policy forms the basis for understanding the why
