Information Security: Protecting the Global Enterprise [Paperback]

Donald L. Pipkin (Author)

Book Description

ISBN-10: 0130173231 | ISBN-13: 978-0130173232 | Publication Date: May 22, 2000 | Edition: 1

In this book, IT security expert Donald Pipkin addresses every aspect of information security: the business issues, the technical process issues, and the legal issues. Pipkin starts by reviewing the key business issues: estimating the value of information assets, evaluating the cost to the organization if they are lost or disclosed, and determining the appropriate levels of protection and response to security incidents. Next, he walks through the technical processes required to build a consistent, reasonable information security system, with appropriate intrusion detection and reporting features. Finally, Pipkin reviews the legal issues associated with information security, including corporate officers' personal liability for taking care that information is protected. The book's coverage is applicable to businesses of any size, from 50 employees to 50,000 or more, and ideal for everyone who needs at least a basic understanding of information security: network/system administrators, managers, planners, architects, and executives alike.

Editorial Reviews

From the Inside Flap

Preface

Information security is more than computer data security. It is the process of protecting the intellectual property of an organization. This intellectual property is paramount to the organization's survival. Businesses are built on their information — their company secrets. These secrets may be secret ingredients, manufacturing methods, pricing agreements with suppliers, or customer lists. All of these business secrets contribute to the profitability of the company. They all must be protected.

Everyone is involved in, and in some part responsible for, the safekeeping of information. One leak can sink the entire organization. Information must be continuously protected from all sides. This requires that everyone must understand and utilize the security that protects information.

There are no simple answers to the issues of security. Unfortunately, people are all too often convinced that all they need to do to secure their information systems is to install a firewall, improve their authentication method, or write a security policy. True, each of these can help improve security, but none of them is a complete solution.

Dependence on computerized information systems is integral to all aspects of an organization. Information-related problems must be understood and managed, the same as any other business resource. Management must recognize the importance of setting policies, standards, and procedures for the protection of information and allocation of resources to achieve it. This book details the relationship between security policies and procedures and clarifies how they can reduce the chance of losses on information systems. It is a must for anyone who is responsible for information assets or a complete overview of information security.

This book is designed to unveil the breadth of issues that encompasses information security. It is an introduction to information security addressing both the business issues and the fundamental aspects of securing information. It is not going to give you directions to close any specific security problem. However, it will open your eyes to security issues that are often overlooked. It delves into the issues involved with understanding the value of information assets, their potential cost to the organization if they are lost or disclosed, and how to determine the appropriate level of protection and response to a security incident; the technical process involved with building an information security design that is consistent, reasonable, and which utilizes appropriate intrusion detection and reporting systems; and the legal issues which require adequate protection and an appropriate response, so that not only is the information protected but also the corporate officers who are responsible for the safekeeping of the organization's information assets. It describes essential components of an information resource protection process. This process can be applied to information in any location from a personal computer to a large data processing facility. It is necessary in companies of any size — from 50 employees to 50,000 or more.

This book is derived from numerous presentations to CEOs and CIOs about information security. It addresses the issues from a business perspective, detailing the entire process of information security inside and outside the computer center. It addresses the business concerns of management as they pertain to information security.

In the security evaluations that I have performed for companies both large and small, it has been my experience that organizations have a security "hot button," one aspect of security they have addressed very well, and have overlooked other areas.

This book takes you through the steps of designing an information security program — from evaluating current processes to reviewing incident response procedures. Each section of the book, as follows, addresses one of these major steps which are required for a complete, cohesive information security program:

Inspection is the process of determining the current status and evaluating the appropriate level of security. It is this phase that creates a level of understanding of the issues and the organization's ability to address them. Protection is the proactive process of creating an environment that is as secure as possible. This phase examines the ten fundamental aspects of information security and the issues involved. Detection is the reactive process of determining inappropriate activities and alerting responsible individuals. Detection is required for those things that cannot be protected or predicted. Reaction is the process of responding to a security incident. This phase focuses on resolving a security incident to minimize the impact. Reflection is the follow-up processes necessary to evaluate the quality of the security implementation. These post-incident procedures are necessary for the organization to learn from the incident and share that experience.

This book will also explore the fundamental aspects of information security. These basic building blocks are categorized as follows:

Awareness is assuring that everyone understands the importance of security.

Access defines the medium used to contact the resource.

Identification is what is used to identify a user.

Authentication is how the user's identity is validated.

Authorization is what a user is allowed to do.

Availability is the ability to utilize the resource whenever it is needed.

Accuracy is the assurance that the information is correct.

Confidentiality is keeping the resource from being disclosed.

Accountability is assigning responsibility for actions taken on and by the resource.

Administration is the ability to manage the security attributes of the information.

Each of these aspects must be addressed to adequately protect your information. After reading this book, you will have the knowledge to analyze your information systems' security needs, to best allocate your security resources, and to put into place the proper policies and procedures in order to secure your information.

From the Back Cover

• Information security, start to finish: inspection, protection, detection, reaction, and reflection
• Analyzing your most critical risks and threats
• Defining an information security strategy and architecture
• Planning and responding to intruders
• Legal and public relations implications

Computer and network security: the technical, legal, and business issues.

In Information Security: Protecting the Global Enterprise, IT security expert Donald Pipkin addresses every aspect of information security: the business issues, the technical process issues, and the legal issues—including the personal liabilities of corporate officers in protecting information assets. Pipkin starts by reviewing the key business issues associated with protecting information assets, and determining the appropriate levels of protection and response to security incidents. Next, he walks through the technical processes required to build a consistent, reasonable information security system, with appropriate intrusion detection and reporting features. Coverage includes:

• Inspection: Risk analysis, resource inventory, threat assessment, business impact analysis, safeguards, and more
• Protection: Information security design, vision, architecture, strategies, frameworks, and implementation
• Detection: Types of intruders, methods and profiles of detection
• Reaction: Incident response plans, documentation, determination, notification, assessment, repair, and recovery
• Reflection: Post-incident procedures, timelines, technical and management responses, process improvements, and public relations

Whether your role is technical or managerial, no matter what size your enterprise is, Information Security delivers the insight and guidance you need to protect your most vital asset: information.

See all Editorial Reviews

Product Details

• Paperback: 364 pages
• Publisher: Prentice Hall; 1 edition (May 22, 2000)
• Language: English
• ISBN-10: 0130173231
• ISBN-13: 978-0130173232
• Product Dimensions: 9.2 x 5.6 x 0.9 inches
• Shipping Weight: 1.7 pounds (View shipping rates and policies)
• Average Customer Review: 4.0 out of 5 stars  See all reviews (9 customer reviews)
• Amazon Best Sellers Rank: #697,739 in Books (See Top 100 in Books)

More About the Author

Discover books, learn about writers, read author blogs, and more.

Customer Reviews

Most Helpful Customer Reviews

7 of 7 people found the following review helpful:

5.0 out of 5 stars A comprehensive look at computer security, July 17, 2000

By A Customer

This review is from: Information Security: Protecting the Global Enterprise (Paperback)

Information Security is a must have for anyone involved with computer security. I realized that I've been securing computer systems by focusing on the 3-As (authentication, authorization and audit). This book describes 10 attributes of information security that have to be addressed. It has opened my eyes to areas of security that I had overlooked.

1 of 1 people found the following review helpful:

4.0 out of 5 stars Excellent information security overview, September 30, 2002

By 

Ben Rothke "Author of 'Computer Security: 20 ... (USA) - See all my reviews
(REAL NAME)   

This review is from: Information Security: Protecting the Global Enterprise (Paperback)

Information Security: Protecting the Global Enterprise is a very good guide to those looking for a management level introduction into the core concepts of information security.

Pipkin writes in an easy to understand style without a lot of arcane acronyms or techno speak.

The book has a good step-by-step approach and is a very good starting point for those looking to design their information systems security architecture.

The book is a great place to start ones security roadmap and initiative and as a launching point for more in depth work.

1 of 1 people found the following review helpful:

5.0 out of 5 stars Manage information at enterprise level, January 9, 2002

By 

Ma, Tien Jui (Taipei Taiwan) - See all my reviews
(REAL NAME)   

This review is from: Information Security: Protecting the Global Enterprise (Paperback)

This is a very good book for IT people expand their security scope into enterprise level. Some other books take more an auditor's view, this one provides structures and practices just enough for IT people. Unless your organization need a BS7799 certification, this is the book you need to read through.