REVIEW: A Practical Guide to Managing Information Security

840318-L

by Steve Purser, 2004, (Artech House Technology Management Library) Artech House, Inc. Norwood, MA, USA ©2004 – ISBN:1580537022

____________________________________________________________________

After years of reviewing security books there were a number of red warning flags in the preface: the perception that a book was needed to address the "entire" subject of security, an insistence on a "pragmatic" and management oriented approach, and the use of a "fictitious but realistic case study" to support the arguments in the work. The final omen came in the author's bio on the back cover: he's a banker. Chapter one is a vague statement that the information technology world is getting riskier, but states outright the irresponsible notion that it is better to provide a less secure product to customers as long as that reduces your "time to market." This is backed up by a great deal of waffling managementspeak that boils down to the idea that we have to learn to work faster *and* cheaper *and* better *and* smarter. The footnotes and references intended to demonstrate that this is a scholarly and researched effort are, instead, a grab bag of varying origin and quality, indicating that the author isn't really familiar with security literature, and used whatever he happened to read. A few security information sources and generic advice on planning is in chapter two. The taxonomy of technical tools, in chapter three, contains no entries for accounting, application development, operations, physical security, assurance, or business continuity, thus indicating the enormous gaps in this work. The artificial structure imposed on the list works against an integrated view of the tools: Purser obviously doesn't understand intrusion detection divisions, or that host-based and net-based systems both provide details–but of differing views. In chapter four, Purser obviously thinks that he is giving us new insight into security assessment, when all that is really..

Read more: http://archive.cert.uni-stuttgart.de/isn/2004/10/msg00033.html