Executive Guide to Information Security, The: Threats, Challenges, and Solutions

Executive Guide to Information Security, The: Threats, Challenges, and Solutions

by Mark Egan
Released November 2004
Publisher(s): Addison-Wesley Professional
ISBN: 0321304519

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Praise for The Executive Guide to Information Security

"In today's world, no business can operate without securing its computers. This book conveys that message in clear, concise terms and acts as a tremendous primer to CEOs."

–from the Foreword by Richard A. Clarke

"Every CEO is responsible for protecting the assets of their corporation–the people, intellectual property, corporate and customer information, infrastructure, network, and computing resources. This is becoming both more important and more difficult with the rise in the number and sophistication of cyber threats. This book helps the CEO understand the issues and ask the right questions to implement a more effective strategy for their business."

–Steve Bennett, president and CEO, Intuit

"Mark Egan and Tim Mather help nontechnical executives gain a comprehensive perspective over the security challenges that all companies face today. This book is well structured and practical. Yet, it also stresses that a strategic approach to cyber security is essential, and that "tone at the top" will determine the effectiveness of any corporate cyber security policy."

–Eric Benhamou, chairman of the board of directors, 3Com Corporation, palmOne, and PalmSource, Inc

"This book is not about cyber security; it's about managing one's company and the role that cyber security plays in that scenario. It's chilling to think of how vulnerable the assets of a business are on a computer network; this book is a fire alarm in the night for business executives to realize computer security is not a tech issue–it's a business issue worthy of the same attention and priority that business executives might place on any other mission-critical element of their company."

–George Reyes, CFO, Google

"This is a must read for any executive of any size company. The Internet makes all businesses equal in that they are subject to the same types of threats regardless of their product. In this book, the CIO and security director of one of the top security companies makes the business case for security and tells you what to do to successfully mitigate threats."

–Howard A. Schmidt, former cyber security advisor to the White House, CSO Microsoft, and VP CISO eBay

"This book gives an excellent overview of the issues around securing information at a time in our history when information is extremely vulnerable to outside attack, retrieval, or manipulation. Steps taken now can make a huge difference to a company's ability to survive and thrive in a heterogeneous attack culture."

–Bob Concannon, Global Practice Leader, Boyden Global Executive Search

"Few if any books expose the business executive to the serious and critical nature of existing and evolving security issues using nontechnical terms. Executives can no longer afford to delegate the responsibility and accountability for security without understanding the issues and without assuming the ultimate responsibility for security in the firm. This book should become required reading for every business executive, regardless of product or company size."

–John Moreno, chair, MS in Information Technology, Golden Gate University

"This book details the what, why, and how to solve issues of information security in business today. It gives examples many people will recognize from the press, discusses the basics of information security in a very understandable way, and reviews approaches for addressing these risks and threats."

–David Schwartz, managing director, Derivative Products Risk Advisors, Inc.

"This book fills a void by addressing the key criteria executives need to consider when implementing an effective information security plan within their organization."

–Shobana Gubbi, former project manager of IOS Technologies, Cisco

A Business-Focused Information Security Action Plan for Every Executive

Today, every executive must understand information security from a business perspective. Now, this concise book tells business leaders exactly what they need to know to make intelligent decisions about security–without ever getting lost in the technical complexities.

The Executive Guide to Information Security offers realistic, step-by-step recommendations for evaluating and improving information security in any enterprise. From start to finish, the focus is on action: what works and how to get it done. Here are just a few of the things you will be learning:

  • Understanding your security challenges and obligations

  • Trends in security attacks

  • Systematically identifying your risks and vulnerabilities

  • Implementing best-practice processes for access, acceptable use, training, strategy, and emergency response

  • Effective executive leadership, governance, and metrics

  • Staffing security–coping with a shortage of expertise

    • Whether you're a CxO, a line-of-business executive, or an IT executive who needs to get colleagues up to speed, this is the nontechnical, business-driven security briefing you've been searching for.

    Mark Egan is chief information officer and vice president of the Information Technology Division of Symantec. In this role, he is responsible for all internal systems and security at Symantec. Egan is the co-chair of TechNet's Cyber Security Best Practices Campaign and a frequent speaker on best practices for information security and information technology.

    TIM MATHER, Symantec's vice president and chief information security officer, is responsible for Symantec's information security program. Mather is a Certified Information Systems Security Professional and a Certified Information Systems Manager.

    The authors' profits from this book will support a scholarship program for underprivileged students planning IT careers.

    © Copyright Pearson Education. All rights reserved.

    Table of contents

    1. Copyright
    2. Praise for The Executive Guide to Information Security
    3. Acknowledgments
    4. Foreword
    5. Preface
    6. About the Authors
    7. The Information Security Challenge
      1. Introduction
      2. Understanding the Internet—A Brief History
      3. Six Significant Information Security Challenges
      4. Information Security Challenge Summary
      5. Essential Components for a Successful Information Security Program
      6. Key Points for This Chapter
    8. Information Security Overview
      1. Introduction
      2. Overview
      3. Enterprise Information Security Program
      4. Information Security Overview Summary
      5. Key Points for This Chapter
    9. Developing Your Information Security Program
      1. Introduction
      2. Overview
      3. Information Security Methodology
      4. Business Requirements Analysis—Step 1 of 3
      5. Developing Your Information Security Program Summary
      6. Key Points for This Chapter
    10. People
      1. Introduction
      2. Overview
      3. People—Strategy
      4. People—Components
      5. People—Administration
      6. Design of Your Future Organization
      7. People—Components
      8. People—Administration
      9. People—Architecture
      10. People Summary
      11. Key Points for This Chapter
    11. Process
      1. Introduction
      2. Overview
      3. Process—Strategy
      4. Process—Components
      5. Process—Administration
      6. Design of Your Future Security Processes
      7. Process—Strategy
      8. Process—Components
      9. Emergency Response
      10. Process—Administration
      11. Process Summary
      12. Key Points for This Chapter
    12. Technology
      1. Introduction
      2. Overview
      3. Technology—Strategy
      4. Technology—Components
      5. Technology—Administration
      6. Design of Your Future Security Technology
      7. Technology—Strategy
      8. Technology—Components
      9. Technology—Administration
      10. Technology Summary
      11. Key Points for This Chapter
    13. Information Security Roadmap
      1. Introduction
      2. Overview
      3. High-Level Information Security Concepts
      4. Information Security Assessment Summary
      5. Information Security Gap Analysis
      6. Options to Bridge Information Security Gaps
      7. Information Security Roadmap
      8. Information Security Roadmap Summary
      9. Key Points for This Chapter
    14. View Into the Future
      1. Introduction
      2. Overview
      3. Threat Evolution
      4. Shift in Hacker Demographics and Intentions
      5. Solution Evolution Trends
      6. Security Solution Evolution
      7. View into the Future Summary
      8. Key Points for This Chapter
    15. Summary
      1. Introduction
      2. Overview
      3. Ten Essential Components for a Successful Information Security Program
      4. Essential Components Summary
    16. Security Evaluation Framework
      1. Information Security Business Dependency Matrix
      2. Information Security People Evaluation Template
      3. Information Security Future People Architecture Template
      4. Information Security Process Evaluation Template
      5. Information Security Asset Inventory Example
      6. Information Security Risk Assessment Summary Example
      7. Information Security Future Process Architecture Template
      8. Information Security Technology Evaluation Template
      9. Information Security Future Technology Architecture Template
      10. Information Security Existing Program Evaluation Summary Example
      11. Information Security Business Dependency Matrix Example
      12. Information Security Program Assessment Scoring
      13. Information Security Gap Analysis Example
      14. Information Security Strategic Alternatives Example
      15. Information Security Roadmap Example
      16. Information Security Project Template Example
    17. Information Security Web Sites
      1. Government
      2. Education
      3. Information Security Industry
      4. Other
    18. Operational Security Standards
      1. Government
      2. Industry
      3. Business
    19. Sample Security Job Descriptions
      1. Information Security Director
      2. Information Security Analyst
      3. Information Security Auditor
    20. Glossary
    21. Index

    Product information

    • Title: Executive Guide to Information Security, The: Threats, Challenges, and Solutions
    • Author(s): Mark Egan
    • Release date: November 2004
    • Publisher(s): Addison-Wesley Professional
    • ISBN: 0321304519