Information Security: Protecting the Global Enterprise / Edition 1

Preface

Information security is more than computer data security. It is the process of protecting the intellectual property of an organization. This intellectual property is paramount to the organization's survival. Businesses are built on their information — their company secrets. These secrets may be secret ingredients, manufacturing methods, pricing agreements with suppliers, or customer lists. All of these business secrets contribute to the profitability of the company. They all must be protected.

Everyone is involved in, and in some part responsible for, the safekeeping of information. One leak can sink the entire organization. Information must be continuously protected from all sides. This requires that everyone must understand and utilize the security that protects information.

There are no simple answers to the issues of security. Unfortunately, people are all too often convinced that all they need to do to secure their information systems is to install a firewall, improve their authentication method, or write a security policy. True, each of these can help improve security, but none of them is a complete solution.

Dependence on computerized information systems is integral to all aspects of an organization. Information-related problems must be understood and managed, the same as any other business resource. Management must recognize the importance of setting policies, standards, and procedures for the protection of information and allocation of resources to achieve it. This book details the relationship between security policies and procedures and clarifies how they can reduce the chance of losses on information systems. It is a must for anyone who is responsible for information assets or a complete overview of information security.

This book is designed to unveil the breadth of issues that encompasses information security. It is an introduction to information security addressing both the business issues and the fundamental aspects of securing information. It is not going to give you directions to close any specific security problem. However, it will open your eyes to security issues that are often overlooked. It delves into the issues involved with understanding the value of information assets, their potential cost to the organization if they are lost or disclosed, and how to determine the appropriate level of protection and response to a security incident; the technical process involved with building an information security design that is consistent, reasonable, and which utilizes appropriate intrusion detection and reporting systems; and the legal issues which require adequate protection and an appropriate response, so that not only is the information protected but also the corporate officers who are responsible for the safekeeping of the organization's information assets. It describes essential components of an information resource protection process. This process can be applied to information in any location from a personal computer to a large data processing facility. It is necessary in companies of any size — from 50 employees to 50,000 or more.

This book is derived from numerous presentations to CEOs and CIOs about information security. It addresses the issues from a business perspective, detailing the entire process of information security inside and outside the computer center. It addresses the business concerns of management as they pertain to information security.

In the security evaluations that I have performed for companies both large and small, it has been my experience that organizations have a security "hot button," one aspect of security they have addressed very well, and have overlooked other areas.

This book takes you through the steps of designing an information security program — from evaluating current processes to reviewing incident response procedures. Each section of the book, as follows, addresses one of these major steps which are required for a complete, cohesive information security program:

• Inspection is the process of determining the current status and evaluating the appropriate level of security. It is this phase that creates a level of understanding of the issues and the organization's ability to address them.
• Protection is the proactive process of creating an environment that is as secure as possible. This phase examines the ten fundamental aspects of information security and the issues involved.
• Detection is the reactive process of determining inappropriate activities and alerting responsible individuals. Detection is required for those things that cannot be protected or predicted.
• Reaction is the process of responding to a security incident. This phase focuses on resolving a security incident to minimize the impact.
• Reflection is the follow-up processes necessary to evaluate the quality of the security implementation. These post-incident procedures are necessary for the organization to learn from the incident and share that experience.
  

This book will also explore the fundamental aspects of information security. These basic building blocks are categorized as follows:

• Awareness is assuring that everyone understands the importance of security.
• Access defines the medium used to contact the resource.
• Identification is what is used to identify a user.
• Authentication is how the user's identity is validated.
• Authorization is what a user is allowed to do.
• Availability is the ability to utilize the resource whenever it is needed.
• Accuracy is the assurance that the information is correct.
• Confidentiality is keeping the resource from being disclosed.
• Accountability is assigning responsibility for actions taken on and by the resource.
• Administration is the ability to manage the security attributes of the information.
  

Each of these aspects must be addressed to adequately protect your information. After reading this book, you will have the knowledge to analyze your information systems' security needs, to best allocate your security resources, and to put into place the proper policies and procedures in order to secure your information.