CSSLP Certification All-in-One Exam Guide, Second Edition, 2nd Edition

CHAPTER 5

Policy Decomposition

In this chapter, you will

•   Learn how policy can be decomposed into security requirements

•   Examine the specifics of confidentiality, integrity, and availability requirements

•   Explore authentication, authorization, and auditing requirements

•   Explore the connection between audit and security requirements

Policy decomposition involves the mapping of high-level policy statements into lower-level policies, a process that can be repeated until the policies are implementable. Policy is a term that can have several meanings, depending upon the context of its use. The National Institute of Standards and Technology (NIST) categorizes computer security policies into three types: program policies, issue-specific ...