Management Of Information Security | 
 enlarge | Authors: Michael E. Whitman, Herbert J. Mattord
Publisher: Course Technology
Category: Book
List Price: $97.95
Buy New: $34.49
You Save: $63.46 (65%)
New (50) Used (41) from $34.49
Avg. Customer Rating:  4 reviews
Sales Rank: 404330
Media: Paperback
Edition: 2
Number Of Items: 1
Pages: 600
Shipping Weight (lbs): 2.2
Dimensions (in): 8.9 x 7.3 x 1.3
ISBN: 1423901304
Dewey Decimal Number: 658
EAN: 9781423901303
ASIN: 1423901304
Publication Date: March 27, 2007
Availability: Usually ships in 1-2 business days
|
| Also Available In:
|
| Accessories:
|
| Similar Items:
|
| Editorial Reviews:
Product Description
Information security-driven topic coverage is the basis for this updated book that will benefit readers in the information technology and business fields alike. Management of Information Security, provides an overview of information security from a management perspective, as well as a thorough understanding of the administration of information security. Written by two Certified Information Systems Security Professionals (CISSP), this book has the added credibility of incorporating the CISSP Common Body of Knowledge (CBK), especially in the area of information security management. The second edition has been updated to maintain the industry currency and academic relevance that made the previous edition so popular, and case studies and examples continue to populate the book, providing real-life applications for the topics covered.
|
| Customer Reviews:
 Good to go April 2, 2007
0 out of 7 found this review helpful
Product was delivered on time and in the condition as described. Good deal.
Need a InfoSec Book? March 28, 2007
1 out of 1 found this review helpful
This book covers everything pertaining to managing Information Security. This book is very informative. I currently have this book in my library, where i still use it as a reference when writing information security related papers.
 Boring, boring, boring July 6, 2006
6 out of 11 found this review helpful
Did I tell you the book was boring?
The authors spend too much time providing the "how to" on developing paperwork (paper-tiger) security programs and nothing on the implementation of real security measures.
They borrow whole chapters out of books written by some guy -- Charles Cresson Wood -- heck, just buy that guy's book instead.
They introduce each chapter with a cursory view of "the threat" yet spend no time explaining how it applies to the chapter.
They do ensure that the reader understands the importance of "making sure your CISO is high enough up the management chain to be effective." Chapter after chapter after chapter!!!!
I've seen better strategic planning in a comic book.
Philosophical (Textbook) exposition of InfoSec November 6, 2004
17 out of 19 found this review helpful
If you're looking to get down into the nitty-gritty of infosec, for ways and methods of securing networks and systems, then this probably isn't the book you need. This is a textbook and so it overs a fairly high level viewpoint, even philosophical approach, to infosec. The granualarity just isn't there for the practising person to gain much from this in a substantive way.
That said, the book does provide a readable and useful overview of all aspects of the infosec planning and administration process. Each chapter has questions yet no answers. Chapters include:
Introduction to the management of info sec
Planning for infosec
Planning for contingencies
Information security policy
Developing the security program
Security Management models and practices
Risk Management: identifying and assessning risk
RIsk Management: Assessing and controlling risk
Protectiion Mechanisms
Personnel and security
Law and Ethics
Information Security Project management (the weakest chapter in the book...meant as an introduction)
While the authors won't tell you how to configure a firewall for example, they will teach you who, how and why this must be done and what must be done to guide and support decisions like this in an organizational environment. This book is about top down security management. It teaches you to use policy, procedures, people, programs, projects and planning in a three dimenional security matrix: confidentiality, integrity, availability, security, transmission, processing, policy, technology and education/training with regard to people, data, hardware, software and procedures, all within the methodology of the secSDLC. So it is a philsophical journey thorugh the heart of the matter written by two guys who obviously know and enjoy their subject.
This books is well written and has a number inserts highlighting differrent things like different types of attacks, concepts like human firewalls and such that enhance the readability while leading a connection to reality that threatens to become a little tenuous when dealing with much abstraction.
SO, a good textbook. I used it for a subject I took and found it useful. WHile it may be a little dry at times, due to the technical nature of the material, if you are serious about learning information security then the need to be consistently entertained is probably just a little alien to your nature anyway. This book will give you an excellent grounding in the things you should be condisering and doing when planning, analyzing, designing, implementing and managing and maintaining infosec.
An excellent addition and support for the material presented in the book- as referred by the authors- is bunch of free materials published by the National Institute of Standards and Technology, found at the computer security resource center. These include papers such as SP 800-12, SP 800-14, and so forth. The website is http://csrc.nist.gov/publications/nistpubs/ It is important to check this out if you are serious about infosec. This book is a good starting point for deliving deeper into that world.
|
|
|
News 
