title: Defining a security policy for a system
body: <p>Most of the literature on security talks about the importance of defining a security policy before starting to workout on the mechanisms and implementation. While this seems logical, it is quite unclear as to what defining a security policy really means. </p>
  
  <p>Has anyone here had any experience in defining a security policy, and if so:</p>
  
  <p>1) What is the outcome of such a definition? Is the form of such a policy, for say distributed system, a document containing a series of statements on the security requirements (what is allowed and what is not) of the system? </p>
  
  <p>2) Can the policy take the a machine readable form (if that makes sense) and if so how can it be used? </p>
  
  <p>3) How does one maintain such a policy? Is policy maintained as documentation (as with all the rest of the documentation) on the system?</p>
  
  <p>4) Is is necessary to make references to the policy document in code?</p>
  
  <p>Brian</p>