Chapter 1: Analyzing Security Policies, Procedures, and Requirements

---

Overview

Every day, your computer systems and the data they contain are at risk for theft, corruption, or misuse. These risks can come from, for example, malicious crackers outside your organization, internal personnel looking to profit from the data, or careless employees accidentally deleting data. The confidentiality, integrity, and availability of your data need to be protected. Before you can protect your data on a Windows Server 2003 network, you need to know what the policies, procedures, and requirements of the business are for security.

Securing a Windows Server 2003 network means you need to identify the assets that you need to protect, therefore allowing the business to continue to operate without disruptions caused by attackers or viruses. You will also need to evaluate the current security policies and practices to see if they are in line with the security needs of the business. These plans and procedures need to be evaluated and reevaluated as the use of the data and the network changes. This requires that the administrative staff and you understand technical constraints and design security that works within the constraints to meet the needs of the business. Finally, you will need to identify any technical constraints that will be a barrier to providing for the security requirements of the business and how you will overcome them.

In this chapter, you will learn how to evaluate the current IT security policies and procedures and analyze the organization’s requirements for securing data. You will also learn how to evaluate risks of current IT practices with regard to security and how the current technologies and requirements of interoperability within the organization impact security.

---