Security Policies and Countermeasures
Bruce Schneier · 2015
A security policy for a system is like a foreign policy for a government: It defines the aims and goals. it provides a framework for selecting and implementing countermeasures against the threats. In any case, the security policy needs to outline “why” and not “how”. The hows are tactics: the countermeasures. As hard as it is to figure out what the policy should be, it's even harder to find a set of countermeasures that implement the policy. This chapter presents examples of online gaming community, automatic teller machines (ATMs), computerized lottery terminals, and two different protection mechanisms including smart cards and magnetic stripe memory cards. Good countermeasures not only protect against the threats, but protect against unforeseen problems.