Infosec books for IT managers

Computerworld - There's a wealth of books for technologists, but there are few high-level books on security for managers. Here are my recommendations on titles that can help you better manage security systems in the enterprise.

Business-centric Titles

Most technology managers grew up in technology: They worked their way through the ranks in software development, systems administration or operations. While they're well versed in one particular technology, most don't have in-depth experience in all of the services for which they are now responsible. And many are weak in knowledge and skills related to the business they're supporting.

For IT managers new to the juncture of technology and business, I recommend Achieving Business Value from Technology: A Practical Guide for Today's Executive, by Tony Murphy (John Wiley and Sons, 2002). This pragmatic book presents the contribution of technology to business in easy-to-understand language. Managers who need to understand the link between business and technology should read Chapter 2, which describes "Five Pillars of Benefits Realization," paying close attention to the sections on "Strategic Alignment" and "Business Process Impact."

I say this because many people in IT organizations, especially younger managers who grew up in the drunken debauchery of the technology-centric 1990s, need to get their feet back on the ground and pay close attention to the value that technology plays in the success of the business.

Broad IT Security

Peter H. Gregory, CISSP, CISA, is an information technology and security consultant, a freelance writer and an author of several books, including "Solaris Security," "Enterprise Information Security," and "CISSP for Dummies." As a consultant he provides strategic technology and security services to small and large businesses. He can be reached at p.gregory@hartgregorygroup.com. His Web site is www.hartgregorygroup.com.

Chapter 15, "Protecting the Information Infrastructure," provides a broad look at the basics for protecting a technology environment. However, just as there is no accounting for taste, professional knowledge and experience vary widely from one individual to the next, and out of 54 chapters, there are bound to be a few that are of particular value to technology managers.

Security Practices

IT managers who need to stay on top of the best current practices should consider The CERT Guide to System and Network Security Practices, by Julia Allen (Addison-Wesley, 2001). The reader will learn the steps that need to be taken to protect systems (which is what most IT managers need to know), but not the details, which are left for you to do, based on your operating system, applications and other specifics of your system.