RE: Security policy and risk analysis questions

["Jiri Ludvik" <ludvik () rac cz>]

It seems that this group shouldn't be firewall-wizards but security-wizards;-)
Since there are people here who are not just in the technology box I would like
to ask about real world use of risk analysis. There are methods, there are
tools, but when looking at security resources on the net , it seems that
baseline approach to developing secuity policy is more prevailing than the risk
analysis one. At least in non-government sector. Am I correct in my overseas
views?

BTW, what is the difference between assessment and analysis? It's more language
question, I see no difference between them in my language, but in English there
probably is some...

Jiri Ludvik