Information Security: Protecting the Global Enterprise - Softcover

Pipkin, Donald

3.67

9 ratings by Goodreads

9780130173232: Information Security: Protecting the Global Enterprise

Softcover

ISBN 10: 0130173231 ISBN 13: 9780130173232

Publisher: Prentice Hall, 2000

View all copies of this ISBN edition:

PLEASE PROVIDE COURSE INFORMATIONPLEASE PROVIDE

"synopsis" may belong to another edition of this title.

From the Inside Flap:

Preface

Information security is more than computer data security. It is the process of protecting the intellectual property of an organization. This intellectual property is paramount to the organization's survival. Businesses are built on their information — their company secrets. These secrets may be secret ingredients, manufacturing methods, pricing agreements with suppliers, or customer lists. All of these business secrets contribute to the profitability of the company. They all must be protected.

Everyone is involved in, and in some part responsible for, the safekeeping of information. One leak can sink the entire organization. Information must be continuously protected from all sides. This requires that everyone must understand and utilize the security that protects information.

There are no simple answers to the issues of security. Unfortunately, people are all too often convinced that all they need to do to secure their information systems is to install a firewall, improve their authentication method, or write a security policy. True, each of these can help improve security, but none of them is a complete solution.

Dependence on computerized information systems is integral to all aspects of an organization. Information-related problems must be understood and managed, the same as any other business resource. Management must recognize the importance of setting policies, standards, and procedures for the protection of information and allocation of resources to achieve it. This book details the relationship between security policies and procedures and clarifies how they can reduce the chance of losses on information systems. It is a must for anyone who is responsible for information assets or a complete overview of information security.

This book is designed to unveil the breadth of issues that encompasses information security. It is an introduction to information security addressing both the business issues and the fundamental aspects of securing information. It is not going to give you directions to close any specific security problem. However, it will open your eyes to security issues that are often overlooked. It delves into the issues involved with understanding the value of information assets, their potential cost to the organization if they are lost or disclosed, and how to determine the appropriate level of protection and response to a security incident; the technical process involved with building an information security design that is consistent, reasonable, and which utilizes appropriate intrusion detection and reporting systems; and the legal issues which require adequate protection and an appropriate response, so that not only is the information protected but also the corporate officers who are responsible for the safekeeping of the organization's information assets. It describes essential components of an information resource protection process. This process can be applied to information in any location from a personal computer to a large data processing facility. It is necessary in companies of any size — from 50 employees to 50,000 or more.

This book is derived from numerous presentations to CEOs and CIOs about information security. It addresses the issues from a business perspective, detailing the entire process of information security inside and outside the computer center. It addresses the business concerns of management as they pertain to information security.

In the security evaluations that I have performed for companies both large and small, it has been my experience that organizations have a security "hot button," one aspect of security they have addressed very well, and have overlooked other areas.

This book takes you through the steps of designing an information security program — from evaluating current processes to reviewing incident response procedures. Each section of the book, as follows, addresses one of these major steps which are required for a complete, cohesive information security program:

Inspection is the process of determining the current status and evaluating the appropriate level of security. It is this phase that creates a level of understanding of the issues and the organization's ability to address them. Protection is the proactive process of creating an environment that is as secure as possible. This phase examines the ten fundamental aspects of information security and the issues involved. Detection is the reactive process of determining inappropriate activities and alerting responsible individuals. Detection is required for those things that cannot be protected or predicted. Reaction is the process of responding to a security incident. This phase focuses on resolving a security incident to minimize the impact. Reflection is the follow-up processes necessary to evaluate the quality of the security implementation. These post-incident procedures are necessary for the organization to learn from the incident and share that experience.

This book will also explore the fundamental aspects of information security. These basic building blocks are categorized as follows:

Awareness is assuring that everyone understands the importance of security.

Access defines the medium used to contact the resource.

Identification is what is used to identify a user.

Authentication is how the user's identity is validated.

Authorization is what a user is allowed to do.

Availability is the ability to utilize the resource whenever it is needed.

Accuracy is the assurance that the information is correct.

Confidentiality is keeping the resource from being disclosed.

Accountability is assigning responsibility for actions taken on and by the resource.

Administration is the ability to manage the security attributes of the information.

Each of these aspects must be addressed to adequately protect your information. After reading this book, you will have the knowledge to analyze your information systems' security needs, to best allocate your security resources, and to put into place the proper policies and procedures in order to secure your information.

From the Back Cover:

Information security, start to finish: inspection, protection, detection, reaction, and reflection
Analyzing your most critical risks and threats
Defining an information security strategy and architecture
Planning and responding to intruders
Legal and public relations implications

Computer and network security: the technical, legal, and business issues.

In Information Security: Protecting the Global Enterprise, IT security expert Donald Pipkin addresses every aspect of information security: the business issues, the technical process issues, and the legal issues—including the personal liabilities of corporate officers in protecting information assets. Pipkin starts by reviewing the key business issues associated with protecting information assets, and determining the appropriate levels of protection and response to security incidents. Next, he walks through the technical processes required to build a consistent, reasonable information security system, with appropriate intrusion detection and reporting features. Coverage includes:

Inspection: Risk analysis, resource inventory, threat assessment, business impact analysis, safeguards, and more
Protection: Information security design, vision, architecture, strategies, frameworks, and implementation
Detection: Types of intruders, methods and profiles of detection
Reaction: Incident response plans, documentation, determination, notification, assessment, repair, and recovery
Reflection: Post-incident procedures, timelines, technical and management responses, process improvements, and public relations

Whether your role is technical or managerial, no matter what size your enterprise is, Information Security delivers the insight and guidance you need to protect your most vital asset: information.

"About this title" may belong to another edition of this title.