Quá trình này là một khái niệm tuyệt vời, nhưng đôi khi tôi thấy rằng thực tế làm việc của quá trình là không rõ ràng như là quá trình tự. Phụ lục này là nhằm đặt ra như thế nào quá trình này có thể được thực hiện tại một tổ chức. Đối với các cuộc thảo luận này, chúng ta hãy giả định rằng chúng ta đang nói về một tổ chức cỡ vừa (500 nhân viên, một số địa điểm ở phần phía Đông của Hoa Kỳ) | APPENDIX A_ The Process Project Plan Copyright 2001 The McGraw-Hill Companies Inc. Click Here for Terms of Use. 343 344 Network Security A Beginner s Guide In Chapter 7 we talked about the information security process. In that chapter five phases were identified in the process Assessment Policy Implementation Training Audit The process is a wonderful concept but I sometimes find that the actual doing of the process is not as obvious as the process itself. This appendix is intended to lay out how the process might be performed at an organization. For this discussion let s assume that we are talking about a mid-sized organization 500 employees several locations in the eastern portion of the United States . The industry does not matter for this discussion. We will assume that the organization wishes to improve its security posture and has given the security officer of the company a year to accomplish something. The question is what can we accomplish in a year The short answer is a lot. Of course exactly what is accomplished depends upon the risks to the organization and the amount of resources the organization is willing to put against the problem. For this discussion we will assume that the management of the organization is behind this effort and the resources provided to the security officer are appropriate for the project. Figure A-1 shows the very high-level project plan for the security project. As you can see from the plan the process is followed but the steps in the process are not conducted in Assessment Policy Implementation Training Audit Phase I Phase II Phase III Phase IV Assessment Critical fixes Update Ongoing work T T T T Figure A-1. High-level security project plan 345 Appendix A The Process Project Plan serial order but rather in parallel. As we talk about what is being done later in this discussion you will begin to see why this can and should be done. I have also divided the project plan into phases. Specifically there are four major phases of the .
