Difference between Process and Practice in Information Security

Question

I'm learning from the "Information Security" book and already know what the two terms policy and procedure mean.

While these two terms are quite easy to distinguish:

policy is what to do to secure the data and the information system, whereas procedure refers to the steps about how the policy should be enforced.

I came across another two terms: process and practice. There is a book using these 2 terms and the term policy as the book titled "Information Security". In the sense of English, I suppose these two terms have similar meaning with procedure.

I'm not quite sure what the main difference is between process and practice in an Information Security point of view. In addition, when process and practice are added together, do they have the same meaning as procedure or does this rather depend on the context?

Answer 1

Yes you've already got it. Like you mentioned, process is what "should" be done, and practice is what is actually done (akin to theory vs. practice). Try not to get mixed up in minutia like this, though. There are no hard and fast definitions between the terms, and if anyone is being pedantic, just ask them what they're actually talking about.