In some email I received from Bennett Todd, sie wrote: > > But none of this comes near addressing the point you raised: how would > you go about ``verifying that a security policy is any good''? Well, the first step might be to check that it actually exists. The next might be to evaluate it against what the business requires from whatever it controls and what the security risks are. Darren
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 12:57:56 PDT