Security Policies

Good security implementations are based on good security policies. Security begins not with encryption algorithms, firewalls, or advanced authentication techniques; it begins with a clear and well-defined security policy. The policies define the rules by which everyone should abide. They provide the guidance necessary for effective implementations. Put another way, how can you know if someone is breaking the rules if no one has clearly defined what the rules are?