ewalling and encrypting are critical, but are not in themselves an information security strategy. Such a strategy is built on a foundation of policies, guidelines, and procedures. An information security strategy can mitigate risk, but it cannot eliminate risk. Every organization must determine its own risk tolerances for each of its information assets. It needs to know to what extents it will go to protect those assets. An information security strategy should address three goals: confidentiality, integrity, and availability. In most cases, outside assistance is critical to establishing a strong security strategy, and to verifying the strategy is as effective in practice as it is in theory. As one works with a Certified Public Accountant (CPA) for financial accounting, one should work with a Certified Information Systems Security Professional (CISSP) to develop information security strategy. To establish specific information security policies and guidelines, executive management must establish broad policies and standards regarding information assets, including network use. These constitute the foundation of an information security strategy. Nested under the security policies are procedures and policies. In this section, we will highlight areas in which the organization should focus. Security Management Practices Every organization should have a high-level security policy. We define an information security policy as an explicit set of prescribed practices that fosters protection of the enterprise network and of information assets. That policy should state that all information assets are the organization's property, and should define criteria upon which the organization classifies those assets. A key aspect of security management practices is that of privileges and responsibilities. The basic policy regarding privileges is that no-one should have any more privileges than necessary to do their jobs. This minimum access policy fosters diligent division of responsibilities. Security policies should provide a methodol