Security Survey

Before a complete survey report is completed a preliminary survey should be conducted. This preliminary survey is a familiarization, a primary overview to identify the major problem areas within a system affecting security. The preliminary survey will be the foundation for defining the criterion of the final survey report. According to Broder there are at least four questions that should be answered in the preliminary survey.

: What is the operation?

: Who or what is responsible for the operation?

: Why is it done?(where and when?)

: How is the operation accomplished?

In conducting a preliminary survey the first thing that should be completed is the initial interview. Depending on the whether the survey is organizational, functional, or operational the questions will vary. In an organizational survey questions will be people oriented, in a functional survey, questions will be more concerned with work flow, and in operational surveys, questions will be directed toward hardware or software. Regardless of the type of survey the initial interview should answer the following questions: What does management perceive to be the major problem areas? What does management hope the survey will accomplish in regard to solving these problems? (Broder pp60) During the initial interview it is suggested that a management memorandum should be introduced. The purpose of this memorandum is to introduce the survey team, describes the objectives, and authorizing the team to documents and information that may be requested by the team.

Another essential element in the preliminary survey is obtaining information. Information that needs to be obtained, if applicable is the: Charter of the organization, which are polices, responsibilities, and goals of the organization. Financial information that bears any information on the subjects that are going to be surveyed is also important to have during the preliminary survey. Also, operating instructions, which is an understanding...