The Information Systems Security Officer's Guide

2nd Edition

Establishing and Managing an Information Protection Program


  • Gerald Kovacich
  • Table of Contents

    Section I: The Working Environment of an ISSO; Understanding the Information World Environment; Understanding the Business and Management Environment; Understanding Today's Threats to Information Assets; The International Widget Corporation (IWC); Section II: The Duties and Responsibilities of an ISSO; The ISSO's Position, Duties and Responsibilities; The InfoSec Strategic, Tactical, and Annual Plans; Establishing a CIAPP and InfoSec Organization; Determining and Establishing InfoSec Functions; Establishing a Metrics Management System; Annual Re-Evaluation and Future Plans; High Technology Fraud and Other Crimes Investigative Support; InfoSec in the Interest of National Security. SECTION III: Global, Professional, and Personal Challenges of an ISSO: The Related World of Information Warfare, Information Operations, and Information Assurance; The ISSO and Ethical Conduct; ISSO Career Development; How to Market Yourself as an ISSO; So, Are You Ready to Become an InfoSec Consultant?; 21st Century Challenges for the ISSO


    No. of pages:
    © 2003
    Print ISBN:
    Electronic ISBN:

    About the author

    Gerald Kovacich

    Dr. Kovacich has over 40 years of security, criminal and civil investigations, anti-fraud, information warfare, and information systems security experience in both government as a special agent and as a manager in international corporations. Dr. Kovacich currently resides on an island in Washington state where he continues to write, lecture and conduct research relative to information systems security, information warfare defensive and offensive operations, high-technology crime and techno-terrorism.


    Regardless of where you are in the security hierarchy, this is the definitive text for learning what it takes to be an effective information systems security officer (ISSO). The book paints an excellent portrait of an ISSO's duties, challenges, and working environments. It includes everything from how to handle new technologies and threats to how to perform information-security duties in a national-security environment. Using situations found in actual workplaces, the author leads readers through the process of building an effective corporate information assets protection program (CIAPP) through the fictitious International Widget Corporation. One of the most interesting chapters deals with establishing a metrics-management system, which provides the basics for creating a CIAPP. Metrics management will help ISSOs identify areas needing improvement and methodologies for tracking resource costs and usage. A chapter on investigative support for high-tech crime is germane to today's ISSOs. The author emphasizes the importance of policies that dictate when an investigation will be done internally or when it will involve law enforcement and, in the latter case, what kind of staff support to provide. Information warfare, information operations, and information assurance also receive their due in this book. Understanding these concepts is critical to competing in a global environment. This is a very effective presentation of a broad range of information about a critical security function. It should find a place on the desk of all infosec professionals. - Security Management