The Information Systems Security Officer's Guide

2nd Edition

Establishing and Managing an Information Protection Program


Table of Contents

Section I: The Working Environment of an ISSO; Understanding the Information World Environment; Understanding the Business and Management Environment; Understanding Today's Threats to Information Assets; The International Widget Corporation (IWC); Section II: The Duties and Responsibilities of an ISSO; The ISSO's Position, Duties and Responsibilities; The InfoSec Strategic, Tactical, and Annual Plans; Establishing a CIAPP and InfoSec Organization; Determining and Establishing InfoSec Functions; Establishing a Metrics Management System; Annual Re-Evaluation and Future Plans; High Technology Fraud and Other Crimes Investigative Support; InfoSec in the Interest of National Security. SECTION III: Global, Professional, and Personal Challenges of an ISSO: The Related World of Information Warfare, Information Operations, and Information Assurance; The ISSO and Ethical Conduct; ISSO Career Development; How to Market Yourself as an ISSO; So, Are You Ready to Become an InfoSec Consultant?; 21st Century Challenges for the ISSO


Electronic ISBN:

About the author

Gerald Kovacich

Dr. Gerald L. Kovacich has more than 40 years of experience in industrial, business and government security, investigations, information systems security, and information warfare, both in the U.S. Government as a special agent, in international corporations, and subsequently as an international consultant and lecturer. He retired as the Information Warfare Technologist, Northrop Grumman Corporation to pursue a career as an international consultant, lecturer and writer.


Regardless of where you are in the security hierarchy, this is the definitive text for learning what it takes to be an effective information systems security officer (ISSO). The book paints an excellent portrait of an ISSO's duties, challenges, and working environments. It includes everything from how to handle new technologies and threats to how to perform information-security duties in a national-security environment. Using situations found in actual workplaces, the author leads readers through the process of building an effective corporate information assets protection program (CIAPP) through the fictitious International Widget Corporation. One of the most interesting chapters deals with establishing a metrics-management system, which provides the basics for creating a CIAPP. Metrics management will help ISSOs identify areas needing improvement and methodologies for tracking resource costs and usage. A chapter on investigative support for high-tech crime is germane to today's ISSOs. The author emphasizes the importance of policies that dictate when an investigation will be done internally or when it will involve law enforcement and, in the latter case, what kind of staff support to provide. Information warfare, information operations, and information assurance also receive their due in this book. Understanding these concepts is critical to competing in a global environment. This is a very effective presentation of a broad range of information about a critical security function. It should find a place on the desk of all infosec professionals. - Security Management