There's a wealth of books for technologists, but there are few high-level books on security for managers. Here are my recommendations on titles that can help you better manage security systems in the enterprise.
Business-centric Titles
Most technology managers grew up in technology: They worked their way through the ranks in software development, systems administration or operations. While they're well versed in one particular technology, most don't have in-depth experience in all of the services for which they are now responsible. And many are weak in knowledge and skills related to the business they're supporting.
For IT managers new to the juncture of technology and business, I recommend Achieving Business Value from Technology: A Practical Guide for Today's Executive, by Tony Murphy (John Wiley and Sons, 2002). This pragmatic book presents the contribution of technology to business in easy-to-understand language. Managers who need to understand the link between business and technology should read Chapter 2, which describes "Five Pillars of Benefits Realization," paying close attention to the sections on "Strategic Alignment" and "Business Process Impact."
I say this because many people in IT organizations, especially younger managers who grew up in the drunken debauchery of the technology-centric 1990s, need to get their feet back on the ground and pay close attention to the value that technology plays in the success of the business.
Broad IT Security
 |
 |
|
Peter H. Gregory, CISSP, CISA, is an information technology and security consultant, a freelance writer and an author of several books, including "Solaris Security," "Enterprise Information Security," and "CISSP for Dummies." As a consultant he provides strategic technology and security services to small and large businesses. He can be reached at p.gregory@hartgregorygroup.com. His Web site is www.hartgregorygroup.com. |
For IT managers who want to dive headlong into security topics, I suggest Computer Security Handbook, edited by Seymour Bosworth and Michel E. Kabay (John Wiley and Sons, 2002). This book is a compilation of articles written by several individuals; what it lacks in flow and single-author consistency it makes up with a comprehensive array of topics.
Chapter 15, "Protecting the Information Infrastructure," provides a broad look at the basics for protecting a technology environment. However, just as there is no accounting for taste, professional knowledge and experience vary widely from one individual to the next, and out of 54 chapters, there are bound to be a few that are of particular value to technology managers.
Security Practices
IT managers who need to stay on top of the best current practices should consider The CERT Guide to System and Network Security Practices, by Julia Allen (Addison-Wesley, 2001). The reader will learn the steps that need to be taken to protect systems (which is what most IT managers need to know), but not the details, which are left for you to do, based on your operating system, applications and other specifics of your system.
Issues and Practices
From here, it gets more difficult to make broad-brush book recommendations for most IT managers. I'll go out on a limb and mention some titles in areas that are of interest to many organizations today.
First, Building Secure Software: How to Avoid Security Problems the Right Way, by John Viega and Gary McGraw (Addison-Wesley, 2001), explores the whole business of software development and security.
Writing Secure Code, by Michael Howard and David C. LeBlanc (Microsoft Press, 2002), is also a popular title. It's decidedly Microsoft-centric, but so too are many development shops nowadays. Organizations doing little or no Microsoft development will receive limited value from this book.
For IT managers interested in intrusion detection, there are two titles worth a look: Network Intrusion Detection, by Stephen Northcutt and Judy Novak (New Riders, 2002), and Intrusion Detection, by Rebecca Bace (Pearson 1999).
In organizations running Web sites, IT managers should get a copy of Web Security Sourcebook, by Aviel D. Rubin, Daniel Geer and Marcus J. Ranum (John Wiley and Sons, 1997). While hands-on technologists may pass on this 5-year-old title, the concepts and arguments are every bit as valid today as they were when this book was first published.
A couple of my favorite high-level security titles are Information Security: Protecting the Global Enterprise, by Donald Pipkin (Prentice-Hall, 2000), and Information Security Risk Analysis, by Thomas Peltier (Auerbach, 2000). These provide other management perspectives of information security that will be valuable to those of you who spend a lot of time on the business side.
Technology-specific Titles
Because of the breadth of technologies in use today, it would be fruitless for me to try to compile a useful list for managers. Instead, ask your staff members what they're reading; they may have purchased books that explain how specific technology platforms are best secured.
Arguably, the hands-on IT manager needs to have technology-specific titles on his own bookshelf. The hands-off manager will still benefit from these titles, whether he is leading the way on security issues or just wants to build knowledge and credibility by becoming more familiar with security issues.
Pleasing Everyone (Not!)
There's a glut of books in print, especially for hands-on technologists, but far fewer for managers. I've probably missed a couple of good ones; if you think I'm a bonehead for forgetting your favorite or most-valued title, drop me a line. I may visit this topic again before 2003 is out.
Peter H. Gregory, CISSP, CISA, is a consulting security strategist, freelance writer, and author of several security books. He can be reached at p.gregory@hartgregorygroup.com.