I'm learning from the "Information Security" book and already know what the two terms policy and procedure mean.
While these two terms are quite easy to distinguish:
policy is what to do to secure the data and the information system, whereas procedure refers to the steps about how the policy should be enforced.
I came across another two terms: process and practice. There is a book using these 2 terms and the term policy as the book titled "Information Security". In the sense of English, I suppose these two terms have similar meaning with procedure.
I'm not quite sure what the main difference is between process and practice in an Information Security point of view. In addition, when process and practice are added together, do they have the same meaning as procedure or does this rather depend on the context?