The Executive Guide to Information Security Threats, Challenges, and Solutions

by Egan, Mark; Mather, Tim

• ISBN13: 9780321304513
• ISBN10: 0321304519
• Edition: 1st
• Format: Paperback
• Copyright: 2004-11-30
• Publisher: Addison-Wesley Professional

Summary

A primer on why cyber security is imperative - from the CIO of Symantec, the global leader in information security.

Author Biography

Mark Egan is chief information officer and vice president of the Information Technology Division of Symantec.

Table of Contents

FOREWORD	XIII
PREFACE	XV
1 THE INFORMATION SECURITY CHALLENGE	1	(24)
2 INFORMATION SECURITY OVERVIEW	25	(20)
3 DEVELOPING YOUR INFORMATION SECURITY PROGRAM	45	(20)
4 PEOPLE	65	(32)
5 PROCESS	97	(32)
6 TECHNOLOGY	129	(46)
7 INFORMATION SECURITY ROADMAP	175	(18)
8 VIEW INTO THE FUTURE	193	(24)
9 SUMMARY	217	(8)
APPENDIX A SECURITY EVALUATION FRAMEWORK	225	(18)
APPENDIX B INFORMATION SECURITY WEB SITES	243	(2)
APPENDIX C OPERATIONAL SECURITY STANDARDS	245	(2)
APPENDIX D SAMPLE SECURITY JOB DESCRIPTIONS	247	(8)
GLOSSARY	255	(8)
INDEX	263

Excerpts

Preface Preface Who Is This Book ForThis book is devoted to executives who could benefit from a crash course on information security. We know that you are quite busy, so you need practical recommendations that you can implement quickly. In this book, information security concepts are explained in nontechnical terms to enable executives from any discipline to quickly understand key principles and how to apply them to their business.This book provides a pragmatic approach to evaluating security at your company and putting together an information security program. Key elements of the program include staffing this function at your company, putting the necessary internal processes in place, and implementing the appropriate technology. Business executives will find this book a good primer for understanding the key existing and future security issues and for taking the necessary actions to ensure the protection of their enterprise's information assets. Information Security BackgroundInformation security is no longer an issue that is the responsibility of lower-level staff in the information technology (IT) department. Companies are now conducting a significant portion of their business electronically and need to be confident that their systems are safe and secure. This issue has now been escalated to the Board of Director level, and companies need to take information security seriously. The passage of the Sarbanes-Oxley Act has caused boards and especially audit committees to get much more involved in monitoring the performance and security of key information systems. This act requires companies to make new disclosures about internal controls and includes significant penalties and possible prison terms for executives of companies that are not in compliance.When I started with Symantec in 1999, information security was slowly becoming a major issue that executives had to address. More business was being conducted on the Internet, and system outages gained much more attention from the media. Many companies did not have formal information security programs, and security issues were addressed in an "ad hoc" fashion. Technology solutions at that time consisted mainly of firewalls and anti-virus software that operated independently.One of my challenges with my new position was to quickly gain an understanding of information security because Symantec had shifted its focus to address this market. Most of the literature that was available was very technical and did not provide a good overview for executives of how to put an effective information security program in place. Considering that I had spent the prior 25 years working in information technology, this would have been even more difficult for executives from other disciplines to understand.The industry has changed considerably over the past few years, and a simple virus that was a minor annoyance in the past has shifted to major threats such as Code Red that have caused major disruptions to businesses. Unfortunately, the future does not hold much promise for things to improve, and businesses will need to devote much more attention to this area.The objective of this book is to provide a shortcut for executives to learn more about information security and how it will affect their business in the future. An overview of information security concepts is provided so that executives can be better prepared to evaluate how their company is addressing information security. Pragmatic approaches are provided to assist companies in improving their information security programs. How This Book Is OrganizedThis book focuses on three key themes: people, processes, and technology. These are the key elements of an effective information security program, and it is important to balance these componen