lec:2-1 Security Standards

System managers, security chiefs, and experts, therefore, choose or prefer standards, if no de facto standard exists, that are based on service, industry, size, or mission. The type of service offered by an organization determines the types of security standards used. Like service, the nature of the industry an organization is in also determines the types of services offered by the system, which in turn determines the type of standards to adopt.
First the size of an organization also determines what type of standards to adopt. In relatively small establishments, second the ease of implementation and running of the system influence the standards to be adopted. Finally, the mission of the establishment also determines the types of standards used.
For example, government agencies have a mission that differs from that of a university. These two organizations, therefore, may choose different standards
We are, therefore, going to discuss security standards along these divisions. Before we do that, however, let us look at the bodies and organizations behind the formulation, development, and maintenance of these standards.
These bodies fall into the following categories:
• International organizations such as the Internet Engineering Task Force (IETF), the Institute of Electronic and Electric Engineers (IEEE), the International Standards Organization (ISO), and the International Telecommunication Union (ITU).
• Multinational organizations like the European Committee for Standardization (CEN), Commission of European Union (CEU), and European Telecommunications Standards Institute (ETSI).
• National governmental organizations like the National Institute of Standards and Technology (NIST), American National Standards Institute (ANSI), and Canadian Standards Council (CSC).
• Sector specific organizations such as the European Committee for Banking Standards (ECBS), European Computer Manufacturers Association (ECMA), and Institute of Electronic and Electric Engineers (IEEE).
• Industry standards such as RSA, the Open Group (OSF + X/Open), Object Management