Available:*
Library | Item Barcode | Call Number | Material Type | Item Category 1 | Status |
|---|---|---|---|---|---|
Searching... | 30000004988964 | HF5548.32 E32 2005 | Open Access Book | Book | Searching... |
On Order
Summary
Summary
Praise for The Executive Guide to Information SecurityPraise for The Executive Guide to Information SecurityEvery CEO is responsible for protecting the assets of their corporation--the people, intellectual property, corporate and customer information, infrastructure, network, and computing resources. This is becoming both more important and more difficult with the rise in the number and sophistication of cyber threats. This book helps the CEO understand the issues and ask the right questions to implement a more effective strategy for their business.--Steve Bennett, president and CEO, IntuitMark Egan and Tim Mather help nontechnical executives gain a comprehensive perspective over the security challenges that all companies face today. This book is well structured and practical. Yet, it also stresses that a strategic approach to cyber security is essential, and that tone at the top will determine the effectiveness of any corporate cyber security policy. palmOne, and PalmSource, IncThis book is not about cyber security; it s about managing one s company and the role that cyber security plays in that scenario. It s chilling to think of how vulnerable the assets of a business are on a computer network; this book is a fire alarm in the night for business executives to realize computer security is not a tech issue--it s a business issue worthy of the same attention and priority that business executives might place on any other mission-critical element of their company.--George Reyes, CFO, GoogleThis is a must read for any executive of any size company. The Internet makes all businesses equal in that they are subject to the same types of threats regardless of their product. In this book, the CIO and security director of one of the top security companies makes the business case for security and tells you what to do to successfully mitigate threats.--Howard A. VP CISO eBayThis book gives an excellent overview of the issues around securing information at a time in our history when information is extremely vulnerable to outside attack, retrieval, or manipulation. Steps taken now can make a huge difference to a company s ability to survive and thrive in a heterogeneous attack culture.--Bob Concannon, Global Practice Leader, Boyden Global Executive SearchFew if any books expose the business executive to the serious and critical nature of existing and evolving security issues using nontechnical terms. Executives can no longer afford to delegate the responsibility and accountability for security without understanding the issues and without assuming the ultimate responsibility for security in the firm. This book should become required reading for every business executive, regardless of product or company size.--John Moreno, chair, MS in Information Technology, Golden Gate UniversityThis book details the what, why, and how to solve issues of information security in business today. basics of information security in a very understandable way, and reviews approaches for addressing these risks and threats.--David Schwartz, managing director, Derivative Products Risk Advisors, Inc.This book fills a void by addressing the key criteria executives need to consider when implementing an effective information security plan within their organization.--Shobana Gubbi, former project manager of IOS Technologies, CiscoA Business-Focused Information Security Action Plan for Every ExecutiveToday, every executive must understand information security from a business perspective. Now, this concise book tells business leaders exactly what they need to know to make intelligent decisions about security--without ever getting lost in the technical complexities.The Executive Guide to Information Security offers realistic, step-by-step recommendations for evaluating and improving information security in any enterprise. From start to finish, the focus is on action: what works and how to get it done. security challenges and obligationsTrends in security attacksSystematicall
Author Notes
The Executive Guide to Information Security About the Authors
Mark Egan is Symantec's chief information officer and vice president of information technology. He is responsible for the management of Symantec's internal business systems, computing infrastructure, and information security program. Egan led the rapid transformation of Symantec's internal information systems over the past four years, as the company grew to be the leader in Internet security. Egan brings more than 25 years of information technology experience from a variety of industries. Prior to Symantec, he held several senior-level positions with companies including Sun Microsystems, Price Waterhouse, Atlantic Richfield Corp., Martin Marietta Data Systems, and Wells Fargo Bank. He is a member of the American Management Association's Information Systems and Technology Council and serves on the technical advisory boards for Golden Gate University and the Center for Electronic Business at San Francisco State University. Egan is also co-chair of TechNet's Cyber Security Practices Adoption Campaign. Egan was a contributing author to CIO Wisdom and is a frequent speaker on best practices for information technology and information security.
Egan holds a master's degree in finance and international business from the University of San Diego and a bachelor's degree in computer sciences from the University of Clarion.
Tim Mather is Symantec's vice president and chief information security officer and is a Certified Information Systems Security Professional (CISSP) and a Certified Information Systems Manager (CISM). As the chief information security officer, he is responsible for the development of all information systems security policies, oversight of implementation of all security-related policies and procedures, and all information systems audit-related activities. He also works closely with internal products groups on security capabilities in Symantec products. Prior to joining Symantec in September 1999, Mather was the manager of security at VeriSign. In addition, he was formerly manager of information systems security at Apple Computer. Mather's experience also includes seven years in Washington, D.C. working on secure communications for a classified, national-level command, control, communications, and intelligence (C3I) project, which involved both civilian and military departments and agencies.
Mather holds master's degrees in national security studies from Georgetown University and international policy studies from Monterey Institute of International Studies. He holds a bachelor's degree in political economics from the University of California at Berkeley.
© Copyright Pearson Education. All rights reserved.
Excerpts
Excerpts
Preface Who Is This Book For This book is devoted to executives who could benefit from a crash course on information security. We know that you are quite busy, so you need practical recommendations that you can implement quickly. In this book, information security concepts are explained in nontechnical terms to enable executives from any discipline to quickly understand key principles and how to apply them to their business. This book provides a pragmatic approach to evaluating security at your company and putting together an information security program. Key elements of the program include staffing this function at your company, putting the necessary internal processes in place, and implementing the appropriate technology. Business executives will find this book a good primer for understanding the key existing and future security issues and for taking the necessary actions to ensure the protection of their enterprise's information assets. Information Security Background Information security is no longer an issue that is the responsibility of lower-level staff in the information technology (IT) department. Companies are now conducting a significant portion of their business electronically and need to be confident that their systems are safe and secure. This issue has now been escalated to the Board of Director level, and companies need to take information security seriously. The passage of the Sarbanes-Oxley Act has caused boards and especially audit committees to get much more involved in monitoring the performance and security of key information systems. This act requires companies to make new disclosures about internal controls and includes significant penalties and possible prison terms for executives of companies that are not in compliance. When I started with Symantec in 1999, information security was slowly becoming a major issue that executives had to address. More business was being conducted on the Internet, and system outages gained much more attention from the media. Many companies did not have formal information security programs, and security issues were addressed in an "ad hoc" fashion. Technology solutions at that time consisted mainly of firewalls and anti-virus software that operated independently. One of my challenges with my new position was to quickly gain an understanding of information security because Symantec had shifted its focus to address this market. Most of the literature that was available was very technical and did not provide a good overview for executives of how to put an effective information security program in place. Considering that I had spent the prior 25 years working in information technology, this would have been even more difficult for executives from other disciplines to understand. The industry has changed considerably over the past few years, and a simple virus that was a minor annoyance in the past has shifted to major threats such as Code Red that have caused major disruptions to businesses. Unfortunately, the future does not hold much promise for things to improve, and businesses will need to devote much more attention to this area. The objective of this book is to provide a shortcut for executives to learn more about information security and how it will affect their business in the future. An overview of information security concepts is provided so that executives can be better prepared to evaluate how their company is addressing information security. Pragmatic approaches are provided to assist companies in improving their information security programs. How This Book Is Organized This book focuses on three key themes: people, processes, and technology. These are the key elements of an effective information security program, and it is important to balance these components of the program. Considerable attention has been given to technology in the media and information security literature. However, this is just one element of an effective overall program. The best technology is not going to help if you do not have good staff and processes in place. This book is organized according to the steps you would follow to develop an information security program for your company. Chapter 1, "The Information Security Challenge," provides an overview of information security challenges and why executives should pay attention to the potential risks that these challenges pose to their business. A historical review of the Internet and information security incidents is also covered, and the chapter offers some insight into the power and vulnerability of conducting business electronically. Chapter 2, "Information Security Overview," provides an introduction to information security and the key elements of an effective program. The Security Evaluation Framework is introduced in Chapter 3, "Developing Your Information Security Program," and can be used to evaluate your information security program and develop a roadmap to improve your program. The overall methodology is reviewed, along with the critical areas to ensure success. The next three chapters are devoted to evaluating the people, process, and technology components of your information security program and developing an improvement plan. Chapter 7, "Information Security Roadmap," pulls all this analysis together and describes how to develop your roadmap to an improved information security program that is appropriate for your company. Future trends for information security are reviewed in Chapter 8, "View into the Future," which offers some insight into emerging threats and industry solutions to address these threats. This field is changing rapidly, and it is important to always keep up to date on the latest events. The final chapter lists the 10 essential components to an effective information security program and offers a good summary for anyone who wants to quickly identify areas for improvement. Additional sources of information and references are included in the appendixes. One final point is that this book is written from a vendor-neutral perspective; it does not contain references to commercially available security products and services. The focus is on industry best practices for information security. Due to the rapid changes in this industry, it is difficult to predict which companies will lead as the market evolves. The concepts outlined in this book can serve as a guide to choosing the appropriate products and services to support your program today and in the future. (c) Copyright Pearson Education. All rights reserved. Excerpted from The Executive Guide to Information Security: Threats, Challenges, and Solutions by Mark Egan, Timothy C. Mather, Tim Mather All rights reserved by the original copyright owners. Excerpts are provided for display purposes only and may not be reproduced, reprinted or distributed without the written permission of the publisher.Table of Contents
| Foreword |
| Preface |
| 1 The Information Security Challenge |
| 2 Information Security Overview |
| 3 Developing Your Information Security Program |
| 4 People |
| 5 Process |
| 6 Technology |
| 7 Information Security Roadmap |
| 8 View Into The Future |
| 9 Summary |
| Appendix A Security Evaluation Framework |
| Appendix B Information Security Web Sites |
| Appendix C Operational Security Standards |
| Appendix D Sample Security Job Descriptions |
| Glossary |
| Index |
