Information Security: A Strategic Approach / Edition 1

Paperback (Print)
Used and New from Other Sellers
Used and New from Other Sellers
from $27.85
Usually ships in 1-2 business days
(Save 71%)
Other sellers (Paperback)
  • All (14) from $27.85   
  • New (7) from $73.32   
  • Used (7) from $27.85   


Bridging the gap between information security and strategic planning

This publication is a reflection of the author's firsthand experience as an information security consultant, working for an array of clients in the private and public sectors. Readers discover how to work with their organizations to develop and implement a successful information security plan by improving management practices and by establishing information security as an integral part of overall strategic planning.

The book starts with an overview of basic concepts in strategic planning, information technology strategy, and information security strategy. A practical guide to defining an information security strategy is then provided, covering the "nuts and bolts" of defining long-term information security goals that effectively protect information resources. Separate chapters covering technology strategy and management strategy clearly demonstrate that both are essential, complementary elements in protecting information.

Following this practical introduction to strategy development, subsequent chapters cover the theoretical foundation of an information security strategy, including:
* Examination of key enterprise planning models that correspond to different uses of information and different strategies for securing information
* Review of information economics, an essential link between information security strategy and business strategy
* Role of risk in building an information security strategy

Two separate case studies are developed, helping readers understand how the development and implementation of information security strategies can work within their own organizations.

This is essential reading for information security managers, information technology executives, and consultants. By linking information security to general management strategy, the publication is also recommended for nontechnical executives who need to protect the value and security of their organization's information.

Read More Show Less

Editorial Reviews

From the Publisher
"Executives will quickly learn to see how information security can be addressed...IT security professionals will benefit...from an understanding of how to present information security to nontechnical experts." (Computing, August 15, 2006)

"Useful for information security managers, IT executives, and consultants, the book can also help nontechnical executives who need to protect the value and security of their organization's information." (IEEE Computer Magazine, May 2006)

Read More Show Less

Product Details

  • ISBN-13: 9780471736127
  • Publisher: Wiley
  • Publication date: 4/7/2006
  • Series: Practitioners Series, #11
  • Edition description: New Edition
  • Edition number: 1
  • Pages: 288
  • Product dimensions: 6.42 (w) x 9.27 (h) x 0.62 (d)

Meet the Author

VINCENT LeVEQUE is a Senior Security Engineer for a large systems integrator and technology consulting firm, and previously worked for a large public accounting firm in their informationrisk management practice. He has more than fifteen years' experience in information technology,with an emphasis on information security solutions. His client base has included public utilities, local government, financial institutions, health care, telecommunications, retail, and manufacturers.

Read More Show Less

Table of Contents

List of Figures.


1. Introduction.

Strategy Overview.

Strategy and Information Technology.

Strategy and Information Security.

An Information Security Strategic Planning Methodology.

The Business Environment.

Information Value.


The Strategic Planning Process.

The Technology Plan.

The Management Plan.

Theory and Practice.

2. Developing an Information Security Strategy.


An Information Security Strategy Development Methodology.

Strategy Prerequisites.

Research Sources.

Preliminary Development.

Formal Project Introduction.

Fact Finding.

General Background Information.

Documentation Review.



Research Sources.

Analysis Methods.

Strengths, Weaknesses, Opportunities, and Threats.

Business Systems Planning.

Life-Cycle Methods.

Critical Success Factors.

Economic Analysis.

Risk Analysis.

Benchmarks and Best Practices.

Compliance Requirements.

Analysis Focus Areas.

Industry Environment.

Organizational Mission and Goals.

Executive Governance.

Management Systems and Controls.

Information Technology Management.

Information Technology Architecture.

Security Management.

Draft Plan Presentation.

Final Plan Presentation.

Options for Plan Development.

A Plan Outline.

Selling the Strategy.

Plan Maintenance.

The Security Assessment and the Security Strategy.

Strategy Implementation:

What is a Tactical Plan?

Converting Strategic goals to Tactical Plans.

Turning Tactical Planning Outcomes into Ongoing Operations.

Key Points.

Plan Outline.

3. The Technology Strategy.

Thinking About Technology.

Planning Technology Implementation.

Technology Forecasting.

Some Basic Advice.

Technology Life-Cycle Models.

Technology Solution Evaluation.

Role of Analysts.

Technology Strategy Components:

The Security Strategy Technical Architecture.

Leveraging Existing Vendors.

Legacy Technology.

The Management Dimension.

Overall Technical Design.

The Logical Technology Architecture.

Specific Technical Components.


Network Zones.

External Network Connections.

Desktop Systems.

Applications and DBMS.

Portable Computing Devices.

Telephone Systems.

Control Devices.

Intelligent Peripherals.

Facility Security Systems.

Security Management Systems.

Key Points.

4. The Management Strategy.

Control Systems.

Control Systems and the Information Security Strategy.


Ensuring IT Governance.

IT Governance Models.

Current Issues in Governance.

Control Objectives for Information and Related Technology (CobiT).

IT Balanced Scorecard.

Governance in Information Security.

End-User Role.

An IT Management Model for Information Security.

Policies, Procedures, and Standards.

Assigning Information Security Responsibilities.

To Whom Should Information Security Report?

Executive Roles.

Organizational Interfaces.

Information Security Staff Structure.

Staffing and Funding Levels.

Managing Vendors.

Organizational Culture and Legitimacy.

Training and Awareness.

Key Points.

5. Case Studies.

Case Study 1—Singles Opportunity Services.


Developing the Strategic Plan.

Information Value Analysis.

Risk Analysis.

Technology Strategy.

Management Strategy.


Case Study 2—Rancho Nachos Mosquito Abatement District.


Developing the Strategic Plan.

Information Value Analysis.

Risk Analysis.

Technology Strategy.

Management Strategy.


Key Points.

6. Business and IT Strategy:


Strategy and Systems of Management.

Business Strategy Models.

Boston Consulting Group Business Matrix.

Michael Porter—Competitive Advantage.

Business Process Reengineering.

The Strategy of No Strategy.

IT Strategy.

Nolan/Gibson Stages of Growth.

Information Engineering.

Rockart’s Critical Success Factors.

IBM Business System Planning (BSP).

So is IT really “strategic”?

IT Strategy and Information Security Strategy.

Key Points.

7. Information Economics.

Concepts of Information Protection.

Information Ownership.

From Ownership to Asset.

Information Economics and Information Security.

Basic Economic Principles.

Why is Information Economics Difficult?

Information Value—Reducing Uncertainty.

Information Value—Improved Business Processes.

Information Security Investment Economics.

The Economic Cost of Security Failures.

Future Directions in Information Economics.

Information Management Accounting—Return on Investment.

Economic Models and Management Decision Making.

Information Protection or Information Stewardship?

Key Points.

8. Risk Analysis.

Compliance Versus Risk Approaches.

The “Classic” Risk Analysis Model.

Newer Risk Models.

Process-Oriented Risk Models.

Tree-Based Risk Models.

Organizational Risk Cultures.

Risk Averse, Risk Neutral, and Risk Taking Organizations.

Strategic Versus Tactical Risk Analysis.

When Compliance-based Models are Appropriate.

Risk Mitigation.

Key Points.

Notes and References.


Read More Show Less

Customer Reviews

Be the first to write a review
( 0 )
Rating Distribution

5 Star


4 Star


3 Star


2 Star


1 Star


Your Rating:

Your Name: Create a Pen Name or

Barnes & Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation


  • - By submitting a review, you grant to Barnes & and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Terms of Use.
  • - Barnes & reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously

    If you find inappropriate content, please report it to Barnes & Noble
    Why is this product inappropriate?
    Comments (optional)