Re: A question on security guidelines

Evaluation is allways done compared to some set of goals.  Look to the 
security framework of the organisation that you shall evaluate.  Pick 
the evaluation questions that fits them.

But, it there are no security framework or controls, their issue is much 
bigger than any set of questions can show.

When/if you decide to start preparing and implementing security 
framework/procedures/etc you really should try to do it in a 
well-structured manner.  There are a lot of good procedures out there 
(some cost money, some don't).  I would start by considering PAPAI 
procedures http://www.papai.se/papai/papai_en/index.htm

They could seem to be simple, but simple is beautiful.


/Jakob


> From: Mike Rodriques [mailto:miker@otunet.com] 
> Sent: Thursday, September 23, 2004 12:03 AM
> To: security-management@securityfocus.com
> Subject: A question on security guidelines
>
>
>
>
> I am wondering if you all can point me in the right direction to find a template
> or guide that I can use to evaluate the overall security on a client network.  I
> am looking for something along the lines of a questionnaire or something of that
> nature.
>  
>  
> Thanks in advance
>  
>
> Mike Rodriques


--
Jakob Fredriksson <jf@rfc.se>            Network & Security
Phone: +46 733 776036