Customer Rating:  
Summary: Book is a good foundation upon which to build a security architecture
Comment: Architecture is the art and science of designing buildings and other structures. Using some creative license, it also encompasses the design of any entity, including information systems and their security components. But while no one would build a building without an architect, IT departments routinely design computer systems without considering the security architecture, instead believing that firewalls and other devices are quick and durable fixes.
Nothing could be further from the truth. In Information Security Architecture, author Jan Killmeyer Tudor shows that an effective and comprehensive information security infrastructure is best developed within the framework of an information security architecture (ISA), given today's distributed nature of client/server computing. In the past, when systems were closed and proprietary, security wasn't as compelling a need as it is in today's open systems.
The book covers important ISA issues such as the nature of the organization, policies and standards, baselines and risk assessment, awareness and training, compliance, and more. An underlying message is that these components must work in concert to form a cohesive ISA. Hardware and software are ineffective if they are not integrated into the ISA.
A dominant theme throughout is that implementing security technologies requires an understanding not only of the technologies' return on investment to the organization but also of the risks and vulnerabilities related to these technologies. This ISA methodology gives security professionals an excellent method for achieving just that.
Given how important policy is to an ISA, the book has several appendices that include policies, procedures, and work plans. These provide a fine foundation upon which to build a security architecture.
Customer Rating:
Summary: Is there a lower rating available?
Comment: As a Certified Information Systems Security Professional, I can definitively state that this book does not cover everything that needs to be covered or in any depth whatsoever. I got this book based on the glowing reviews I found here, and I'm at a loss as to why these reviews would have recommended it.
The most aggrevating part about this book is the subtitle "An Integrated Approach to Security in the Organization." The book not only lacks effective security integration techniques, it doesn't seem to address the entire organization where it tries its half-hearted integration.
Customer Rating:
Summary: Unrealistic Drivel
Comment: I question the security background of any of those who read this book and gave it a good review. The author's approach security leaves huge gaps and what is covered is written in a simplistic form... probably because the author only understands a small amount of the topic she is writing about.I question the author's own ability to secure an environment, and she should probably not be teaching others.
Customer Rating:
Summary: Information Security Architechture by Jan Tudor
Comment: I am a CSS student with the College of North Atlantic, St.John's
, Newfoundland. I think that Jan Tudor has put together the "manual" for security within the buisness structure. I am amazed at the debt and scope of this book as there is no stone unturned and information technology people would be at a loss not to read and understand just how security or the lack of it can make or break a buisness, large or small.A true work of art, thanks Jan.
Customer Rating:
Summary: THOROUGH REFERENCE GUIDE
Comment: This was a great reference to start an Information Security Architecture project. There are many guidelines, procedures and forms that take the guess work out of the administration of such a project. The book is great at keeping you on track with your security objectives. I have found that it is so easy with such large projects to lose sight of the objectives. Security is not only technical assessments of the network and operating components but also a combination of management and administration of personnel, policies and procedures and continuous application of pressure to meeting the security requirements of an organization. This book provides excellent value for the price.
|
