Slashdot Mirror
Stepping Through the InfoSec Program
Ben Rothke writes "For those who want to stay current in information security,
Stepping Through the InfoSec Program is a
great book to read after
The
Pragmatic CSO: 12 Steps to Being a Security
Master. While
The Pragmatic CSO provides a first-rate
overview of the higher-level steps to being a CSO and building an information
security program, Stepping Through the InfoSec
Program provides the low-level details and nitty-gritty
elements on just how to do that." Keep reading for the rest of Ben's review.
Stepping Through the InfoSec Program
author
J.L. Bayuk
pages
238
publisher
ISACA
rating
9
reviewer
Ben Rothke
ISBN
1604200308
summary
The low-down on how to build an information security program
Author Jennifer Bayuk spent over a decade at a large brokerage
firm building their information security program.
Her experience in managing and designing security there is
manifest in the book and it is clear throughout the book that she is writing a
deep pool of from real-world experience.
The first part of the book contains 3 sections and in just under 150 densely packed pages, the book walks you through the process in which to build an effective information security program. The book details 6 steps in which to facilitate this, namely: strategy, policy, awareness, implementation, monitoring and remediation.
The book starts out and begins to develop the context for an information security program. It astutely notes that an information security program exists only in the context of an organizational management structure. Anyone building an information security program for its own sake, removed from the organizational management structure will quickly find themselves devoid of a budget, and often shortly after that, out of a job.
The books attention to detail and specific definitions are superb. In the opening section, it defines the objectives, prerequisites, typical tasks and performance measures for over 10 different jobs within information security. It then creates a segregation of duties matrix for these jobs. Such detailed information is invaluable to anyone attempting to build a security program.
The main part of the book is in section 2 which steps through what an information security program is, how it is created, how it operates and what resources are required to maintain it. The beauty of the book is that the author understands that information security is not a monolithic undertaking. Rather it must be developed and customized according to the specific needs and requirements of the particular organization. These differences are made clear in the chapter when it details 9 unique information security reporting hierarchies; and deciding on the appropriate reporting hierarchy is not a trivial undertaking.
The book writes that successful information security program development, by definition, must align with organization goals. This alignment can only be achieved if the CISO has an open, two-way communication path to each manager with information security responsibilities. While this is a necessary and realistic goal, far too few CISO's have such communications paths at their disposal, and even less have constituent ears that are receptive to such communications.
Section two provides an excellent overview of metrics and how they can be effectively used. In the last few years, metrics has been the rage in the security community. Individuals such as Pete Lindstrom and groups such as Security Metrics have been at the forefront of such efforts.
But the book notes that metrics for their own sake can also be taken too far. The book references a volume on metrics that has over 900 possible things to measure that would provide security metrics, including such silly metrics as "number of times, by fiscal year, that fines and jail sentences were imposed for altering, destroying, mutilating, concealing or falsifying financial records". Bayuk perceptively observes that any CISO who is measuring these types of concerns and analyzing them for feedback on how to improve their information security program should realistically look for a different job.
Section 3 concludes the main part of the book with a security program case study. The point of the case study is to show how an information security program evolves around changes in the organization it supports. The case study shows that all of the six steps on which the book is premised are indeed necessary.
The final 100 pages of the book detail various sample security policies, standards, procedures and guidelines. All of the policies, standards, procedures and guidelines are well-written and it would have been nice if these would have been available in electronic format.
The book notes that the information security professional has evolved from computer operator to chief information security officer; from controlling punched cards to negotiating strategic plans, defining policies, documenting processes, managing technology, measuring performance, controlling costs, supporting business recovery and demonstrating regulatory compliance. For those that want to make that transition, Stepping Through the InfoSec Program is a most valuable guide to get you there.
The book is written by an author who has significant amounts of real-world experience in a leading edge organization. That unique knowledge and experience is evident after reading the first few pages of the book. The book provides the reader with a comprehensive overview of how to build an effective information security organization.
One final note, don't judge a book by the cover. On the cover are three busy looking executives, all smiling and looking refreshed. The reality is that most people who have taken the time to build effective security programs often emerge from that battle exhausted and battle weary.
For anyone contemplation entering the information security field, or those in it already that need effective direction, Stepping Through the InfoSec Program should be on their required reading list.
Ben Rothke is the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase Stepping Through the InfoSec Program from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
The first part of the book contains 3 sections and in just under 150 densely packed pages, the book walks you through the process in which to build an effective information security program. The book details 6 steps in which to facilitate this, namely: strategy, policy, awareness, implementation, monitoring and remediation.
The book starts out and begins to develop the context for an information security program. It astutely notes that an information security program exists only in the context of an organizational management structure. Anyone building an information security program for its own sake, removed from the organizational management structure will quickly find themselves devoid of a budget, and often shortly after that, out of a job.
The books attention to detail and specific definitions are superb. In the opening section, it defines the objectives, prerequisites, typical tasks and performance measures for over 10 different jobs within information security. It then creates a segregation of duties matrix for these jobs. Such detailed information is invaluable to anyone attempting to build a security program.
The main part of the book is in section 2 which steps through what an information security program is, how it is created, how it operates and what resources are required to maintain it. The beauty of the book is that the author understands that information security is not a monolithic undertaking. Rather it must be developed and customized according to the specific needs and requirements of the particular organization. These differences are made clear in the chapter when it details 9 unique information security reporting hierarchies; and deciding on the appropriate reporting hierarchy is not a trivial undertaking.
The book writes that successful information security program development, by definition, must align with organization goals. This alignment can only be achieved if the CISO has an open, two-way communication path to each manager with information security responsibilities. While this is a necessary and realistic goal, far too few CISO's have such communications paths at their disposal, and even less have constituent ears that are receptive to such communications.
Section two provides an excellent overview of metrics and how they can be effectively used. In the last few years, metrics has been the rage in the security community. Individuals such as Pete Lindstrom and groups such as Security Metrics have been at the forefront of such efforts.
But the book notes that metrics for their own sake can also be taken too far. The book references a volume on metrics that has over 900 possible things to measure that would provide security metrics, including such silly metrics as "number of times, by fiscal year, that fines and jail sentences were imposed for altering, destroying, mutilating, concealing or falsifying financial records". Bayuk perceptively observes that any CISO who is measuring these types of concerns and analyzing them for feedback on how to improve their information security program should realistically look for a different job.
Section 3 concludes the main part of the book with a security program case study. The point of the case study is to show how an information security program evolves around changes in the organization it supports. The case study shows that all of the six steps on which the book is premised are indeed necessary.
The final 100 pages of the book detail various sample security policies, standards, procedures and guidelines. All of the policies, standards, procedures and guidelines are well-written and it would have been nice if these would have been available in electronic format.
The book notes that the information security professional has evolved from computer operator to chief information security officer; from controlling punched cards to negotiating strategic plans, defining policies, documenting processes, managing technology, measuring performance, controlling costs, supporting business recovery and demonstrating regulatory compliance. For those that want to make that transition, Stepping Through the InfoSec Program is a most valuable guide to get you there.
The book is written by an author who has significant amounts of real-world experience in a leading edge organization. That unique knowledge and experience is evident after reading the first few pages of the book. The book provides the reader with a comprehensive overview of how to build an effective information security organization.
One final note, don't judge a book by the cover. On the cover are three busy looking executives, all smiling and looking refreshed. The reality is that most people who have taken the time to build effective security programs often emerge from that battle exhausted and battle weary.
For anyone contemplation entering the information security field, or those in it already that need effective direction, Stepping Through the InfoSec Program should be on their required reading list.
Ben Rothke is the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase Stepping Through the InfoSec Program from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
I think the danger with books on this topic is that by the time you get them to the publisher, and printed, and distributed, half the content is about to be out of date, and the other half will not be current after one year.
I'm not knocking the book, but in tech matters, I rather keep up via web/new media. tech-philosophy books, now that I like and buy.
-- All this knowledge is giving me a raging brainer.
Here you can review the discussion from the first review of this book:
http://books.slashdot.org/article.pl?sid=08/07/28/1330215
The cover of the book looks straight out of the 80's.. and not the cool 80's either.
Business-side executives who think they can manage without understanding anything at all about the technical details are just as arrogant and dangerous to the bottom line as techies who think they don't need to understand anything about the business.
In a wonderful Dilbert cartoon, the PHB says "Reasoning that anything I don't understand must be easy..." and assigns Dilbert an impossible task predestined for failure.
People on both the money side and the technical side need to work for mutual respect and understanding, and both need to be patient enough to listen to, and understand, material that doesn't fall within their specialty.
Like this?
For those who want to stay current in information security, Stepping Through the InfoSec Program is a great book to read
Yah, really current, books on technology are never current. Even some magazines aren't current, let alone books. Seriously, anyone who wants to be current should subscribe to a mailing list, or at least use magazines which are usually only 1-2 months out of date rather than a book which at best are 3-4 months out of date.
Taxation is legalized theft, no more, no less.
I work in the field. There's only one question I really care about - the rest is just a simple question of reading man pages and documentation and textbooks and writing policies and having meetings and reviewing designs and, and, and. You know. Stuff that you can do.
What I want to know is, how can I make my senior management care?
Seriously. Yes, I've tried all the known things. All I have to cling to now are customer requirements. Show them a pot of gold and, like Valerie Solanos' view of men and sex, they'd wade through a river of warm puke up to their nostrils to get to it, and if that means tossing some budget at security, they'll do it. (So, to answer my own question -- folks who are involved in assessing suppliers - for heaven's sake, ask them about their security, and I mean really ask - don't believe the marketing bullshit, look for independent reviews and certifications. Hell, even an ISO 27001 cert is better than nothing (and that has very little to do with real, on-the-metal infosec.)
Everything I needed to know about life, I learnt from Blake's Seven
have created this monster with the presence of too much information, in the way of X degrees of seperation? Why do VP's copy 10 different people on an email? Then those 10 people copy another 10 other people on the response. Why do they even use email, esp unencrypted when communicating overseas?
Perhaps high level executives should have closed meetings, not use email. Plus email could be compartmentalized so that certain levels of employees could communicate to their bosses and amongst themselves, but no one else.
I would hope that all of government does this, but then perhaps I'm in a dream world. Well Bush did say that he never uses emails with his staff. Perhaps the smartest thing he has ever done in office.
Step one: Admit you are powerless over security--that your systems have become unmanageable.
Ouch, she's a girl!
I'm always skeptical about the people who somehow have the time to read and publish all of these online reviews - many of the are raves for books that nobody has heard of before.
So I Googled Bayuk (author) and Rothke (reviewer) and came up with a presentation they've done together:
www.bayuk.com/publications/BayukSOX.pdf
So, I guess this is nothing more than Ben trying to get us to buy his friend's book.
alas, the 7 seas are a verity of the past, mythology, there are certainly more than 7 seas now.
In case you missed it, recordings have been released from The Last HOPE conference, including Myrcurial's InfoSec talk "From a Black Hat to a Black Suit - How to Climb the Corporate Security Ladder Without Losing Your Soul" [direct link to large 64kbps MP3 file].
Co-operation beats competition