4. Methods

There are several possible approaches to ISS. The first, and simplest, is the purely technical approach, with no explicit security policy: you don't want to touch the existing organization at all, just install a device that filters flows, logs service requests or partitions the network, for example. This type of security is based on automatic systems and corresponds to a predefined security "model" that is applied "intuitively" without prior study. Poor, unspecified and requiring little effort to design and implement, it offers protection only against a low-intensity threat. Does it protect against internal malicious acts? Have all the consequences of a security incident been considered? Do we know how to recover from a disaster? These and many other unanswered questions will resurface with force when the time comes. This way of thinking stems from concepts that are still very prevalent,...