Assessing Information Security: Strategies, Tactics, Logic and Framework

by Andrew Vladimirov, Konstantin Gavrilenko, Andriej Michajlowski

Overview

Information Security is not just about IT
Information security is not perfect. You can tick all the right boxes and acquire the latest technology, but may still fall prey to cyber criminals. This is because information security is not just about IT. In the end, the threats to cyber security comes from human beings as much as from technology. To defend against the wide range of cyber crime vectors requires a multi-faceted, coordinated approach. And that means that senior staff need to understand the nature of the threats.

Leadership
Your company's approach to information security has to be integrated with your overall business goals. Directors have to provide leadership that involves an awareness of cyber security, while the staff engaged in fulfilling corporate objectives on the ground need to understand the company's information security policy and be able to show initiative when faced with an unexpected attack. In short, everyone in the organisation needs to understand the cyber security strategy.

Cybercrime…cyberwar?
Although the people who want to harm your business will try to take you by surprise, they are also bound to have weaknesses of their own. Because the activity of the cybercriminal is both deliberate and hostile, they can be compared to a military adversary. Many people in business understand that the insights from the classics of military strategy are as relevant to modern commerce as they are to war. With this in mind, the authors of this book have drawn on the work of Clausewitz and Sun Tzu and applied it tothe understanding of information security they have built up through their extensive experience in the field. The result is expert guidance on information security, underpinned by a profound understanding of human conflict

Using the strategies and ideas in this book will enable you to:

• Protect your business information. If you do not carry out proper checks, then something will go badly wrong, and your business will suffer. Use this book to help you understand the best way to implement an information security assessment
• Spend money wisely. Information security is not just about having the right equipment. Before you go spending money on fancy gadgets and expensive software, you need to understand what your priorities are, and work out which security measures will be the most effective in protecting your business information.
• Learn to adapt. The reality is that your business information is not stored in a fixed, fortified place like a castle. Your employees could be blackmailed or bribed, or their company laptops may be hacked into or stolen when they are travelling abroad. So, to protect your company's business information, you must avoid a fortress mentality and be capable of adapting to an ever-changing environment.
• Prepare to fight back. Defending your company from malicious hackers, or corruptemployees, is not just a matter of putting appropriate security structures in place. Criminals go for soft targets, but, if they know your company is ready to fight back, they will be deterred from attacking it.

Discover how you can apply ideas from military strategy to create an effective cyber security culture in your organisation

Product Details

ISBN-13:	9781849281263
Publisher:	IT Governance Ltd
Publication date:	03/04/2010
Sold by:	Barnes & Noble
Format:	eBook
Pages:	405
File size:	2 MB

About the Author

Dr Andrew Vladimirov is a security researcher. His fields of expertise include network security and applied cryptography, and he has extensive experience of performing information security assessments. He and his fellow authors are the founders of Arhont Ltd, a leading information security consultancy.

Konstantin Gavrilenko has over 15 years of experience in IT and security. As a researcher, information security is his speciality, and he has a particular interest in wireless security. He holds a BSc in Management Science from DeMontfort University and an MSc in Management from Lancaster University.

Andriej Michajlowski is an expert on network security. His research interests include user and device authentication mechanisms and wireless networking security. He has extensive experience of carrying out internal and external information security assessments. He is a graduate of the University of Kent at Canterbury and he holds an MBA.

Dr Andrew Vladimirov is a security researcher. His fields of expertise include network security and applied cryptography, and he has extensive experience of performing information security assessments. He and his fellow authors are the founders of Arhont Ltd, a leading information security consultancy.

Konstantin Gavrilenko has over 15 years of experience in IT and security. As a researcher, information security is his speciality, and he has a particular interest in wireless security. He holds a BSc in Management Science from DeMontfort University and an MSc in Management from Lancaster University.

Andriej Michajlowski is an expert on network security. His research interests include user and device authentication mechanisms and wireless networking security. He has extensive experience of carrying out internal and external information security assessments. He is a graduate of the University of Kent at Canterbury and he holds an MBA.