A PRACTICAL APPROACH TO SUFFICIENT INFOSEC

[This paper examines an approach to information which is based on providing the customer with “Sufficient INFOSEC” based on needs as determined through a process that includes a business review, risk analysis, engineered solutions, and continuous review. It recognizes the absence of absolute security in any practical sense and promotes “adequate” security based on assurance based risk mitigation. It promotes the idea that security protection needs are dynamic – not static, and environmentally driven. A secondary issue is raised in questioning the lack of flexibility present today in DoD with respect to INFOSEC regulations that fail to take into account the environment being protected.]