News
Commentary
1/21/2005
12:11 PM
David  DeJean
David DeJean
Commentary
Connect Directly
RSS
E-Mail
50%
50%

IT Security, By The Book

Security is the biggest single issue in IT these days. Have you been doing your homework? Here are some recommendations on how to get smarter.

I asked a CIO type what he felt the real issues of the job were. He talked about the interesting questions being how resources get allocated. The toughest problem he saw, as you might expect, was security. "It's never-ending," he said.

The never-ending issue is going to continue to be Job One for IT types for the foreseeable future, and all the knowledge you can gather will be needed in the battle with the bad guys to keep your networks and data secure.

Mike Fratto knows more about this than most of us. He's the editor of Secure Enterprise magazine, and he devoted his column in the current issue to a short list of the best books about information security he's seen. His list should be required reading for everybody who recognizes that security is their Job One. Here are picks, with his comments:

  • Authentication: From Passwords to Public Keys, by Richard E. Smith (Addison-Wesley Professional, 2001). "Not only does the author describe the authentication landscape, he drills down into authentication methods and practical examples."
  • Cryptography and Network Security: Principles and Practice, by William Stallings (Prentice Hall, 2002). "More accessible to nonprogrammers than many other titles on the subject, Stallings' work covers cryptographic fundamentals and describes the technical details in common applications such as S/MIME, IPsec SSL and SET."
  • Introduction to Computer Security, by Matt Bishop (Addison-Wesley Professional, 2004). "This book provides a solid overview of security topics. Although much of the text focuses on theory, Bishop's ideas have proven practical."

Of course, my friend the CIO type makes the very valid point that many security problems are caused not by technology failures, but by human ones -- the password on a Post-It note stuck to the monitor, the user who answers an email that supposedly comes from Tech Support and asks for their login info. Somewhere in the allocation of resources we need to have a line item for the never-ending struggle to educate users.

But we can't do it if we don't know anything ourselves. Read up.

Comment  | 
Print  | 
More Insights
IT's Reputation: What the Data Says
IT's Reputation: What the Data Says
InformationWeek's IT Perception Survey seeks to quantify how IT thinks it's doing versus how the business really views IT's performance in delivering services - and, more important, powering innovation. Our results suggest IT leaders should worry less about whether they're getting enough resources and more about the relationships they have with business unit peers.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Must Reads Oct. 21, 2014
InformationWeek's new Must Reads is a compendium of our best recent coverage of digital strategy. Learn why you should learn to embrace DevOps, how to avoid roadblocks for digital projects, what the five steps to API management are, and more.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
A roundup of the top stories and community news at InformationWeek.com.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.