Visible Ops Security: Achieving Common Security and IT Operations Objectives in 4 Practical Steps (Paperback)

by Gene Kim (Author), Paul Love (Author), George Spafford (Author)
Key Phrases: practical steps, general control processes, information security incidents, Visible Ops Security, Operations Objectives, Visible Ops Handbook (more...)

Editorial Reviews

Review
As an auditor and an IT practitioner, I have repeatedly seen solution-oriented behaviors transform technologists into business partners. Visible Ops Security provides a realistic approach to converting information security from a technical function into a business function. --A.J. Schwab, Senior IT Audit Manager

The book examines what IT security organizations do well and their common struggles. A must read for those in security and audit who seek improvement, but also important and informative for those who work closely with security in business processes, accounting, auditing, development, and operations. The authors understand the problems that keep many IT security organizations from reaching effectiveness or potential, and disarm perceptions that hold these organizations back by offering clear steps to move out of the trenches to the top of their games. --James Bohem, CISSP, Enterprise Security Solutions Architect, MIS Systems Integrators

This is an excellent guide to building a successful IT infrastructure from a security perspective. The authors have masterfully articulated the methodologies used successfully by many of us in security and risk management and I can personally validate their findings. The four phases outlined here provide the framework to stabilize, secure, manage, and improve the security of your IT infrastructure. --Peter Perfetti, Director, IT Security and Risk Management

Product Description
Visible Ops Security builds upon the methodology presented in the original Visible Ops Handbook. It guides information security professionals in strengthening relationships with IT operations and development groups to advance IT objectives and business goals. It addresses the people side of IT, empowering security to work with operations teams to achieve closely aligned objectives and with development and release teams to integrate security requirements into preproduction work. The Visible Ops Security methodology helps IT organizations move beyond a focus on technology to address the core operational aspects of security. It complements publications that focus on securing the network, access, and data, including COBIT (Control Objectives for Information and related Technology), ISO 27001:2005 (International Standards Organization), and ITIL® (IT Infrastructure Library) manuals. It promotes effective teamwork, which helps security professionals ensure that security is built into key development and production processes. This effort positions the IT organization to meet business needs by delivering highly available, cost-effective, and secure services.

Product Details

• Paperback: 112 pages
• Publisher: IT Process Institute, Inc. (March 17, 2008)
• Language: English
• ISBN-10: 0975568620
• ISBN-13: 978-0975568620
• Product Dimensions: 7.8 x 5.4 x 0.3 inches
• Shipping Weight: 6.4 ounces (View shipping rates and policies)
• Average Customer Review: 4.8 out of 5 stars See all reviews (4 customer reviews)
• Amazon.com Sales Rank: #140,959 in Books (See Bestsellers in Books)

  Popular in this category: (What's this?)

  #99 in

  Books > Computers & Internet > Certification Central > Exams > Security+

Customer Reviews

Most Helpful Customer Reviews

3 of 3 people found the following review helpful:

5.0 out of 5 stars Excellent, practical guide to improving operations security, November 20, 2008

By	M. E. KABAY (Barre, VT USA) - See all my reviews (REAL NAME)

Two categories of problems confront IT personnel and the authors provide many specific examples of each:  conflicts between the requirements of normal IT operations or development practices and expectations of security interference of security standards and practices with effective and efficient operations.

Another fundamental problem is that Although IT supports the business in many different ways, IT has two primary functions:  Developing new capabilities and functionality to achieve business objectives Operating and maintaining existing IT services to safeguard business commitments The authors write, Visible Ops Security describes how to resolve this core chronic conflict by enabling the business to simultaneously respond more quickly to urgent business needs and provide stable, security and predictable IT services. The remainder of the Introduction provides an overview of the four phases of the systematic approach to resolving fundamental problems in the operations and security sectors: 1. Stabilize the patient and get plugged into production 2. Find business risks and fix fragile artifacts 3. Implement development and release controls 4. Continual improvement

For a 12-page review originally published in my Network World Security Strategies newsletter online in November 2008, download the following file:

[...]

M. E. Kabay, PhD, CISSP-ISSMP
Operations and Security Management Consultant
Technical Writer and Editor

2 of 2 people found the following review helpful:

5.0 out of 5 stars More good stuff from the Visibe Ops guys, July 10, 2008

By	Alan Cantrell "IT Service Management Program ... (Vanderbilt University Medical Center, Nashville, TN) - See all my reviews (REAL NAME)

When I first got into the world of IT Service Management, the Visible Ops Handbook distilled the important information and delivered something that was missing from the official ITIL literature...how to execute. What I found in the accessible pages of the Visible Ops Handbook was how to justify and start a service management initiative. The beauty of the rationale in Visible Ops lies in the fact that it contains not only wisdom but a believable recipe for success. Visible Ops Security does much the same for information security. The book focuses on pre-production activities where the costs are lower.
Visible Ops Security helps the IT organization understand how to figure out what is important and how to gain a measure of control by developing relationships with key elements of the business and IT organization. Most IT organizations understand that they own a measure of risk due to regulatory requirements, potential loss of brand reputation and the often adversarial relationship between information security and the rest of the IT organization...they just don't know how to quantify or mitigate it. Visible Ops Security shows where to start.

2 of 2 people found the following review helpful:

5.0 out of 5 stars Visible Ops Security, April 20, 2008

By	Sasha Romanosky (Carnegie Mellon University, Pittsburgh, PA) - See all my reviews (REAL NAME)

Visible Ops Security provides the clearest recommendations for improving and sustaining an organization's security operations that I have yet seen. It advocates integrating with, not circumventing, existing IT and business processes. It doesn't advocate security for security's sake but properly recognizes the business purpose for appropriate security policies. The authors are clearly skilled in information security and IT methodologies, and Visible Ops Security reflects this knowledge and experience.