Security Documentation

Information Security Management Standards and Code of Practice provide guidance on good practice for security officers. However there is still a significant gap between the security officer's real world environment and the advice provided by information security professionals and consultants. This paper suggests that a uniform approach to security documentation may provide a first step in bridging that gap, and discusses a proposed structure for such documentation. It is clear from this discussion, however, that a first attempt at security documentation reveals a more fundamental problem, the lack of a working security model. Having documented the local security scenario, the security officer requires some means to extract security relevant information, e.g. to advise management on the current state of organizational security and to recommend security priorities. This paper concludes with a discussion on such a security model.