'Near-perfect' security guide for execs

The Executive Guide to Information Security: Threats, Challenges and Solutions

By Mark Egan and Tim Mather 268 Pages; $34.99       Symantec Press

Shelves are overflowing with books that profess to guide CISOs through virtually any security challenge, from building an infosecurity organization from scratch to tightening existing security policies and processes. However, they're often inappropriate for C-level executives, who need concise, nontechnical, business-driven explanations of what information security really is, what's reasonable to expect from it and how their CISO is going to manage it. This is exactly what The Executive Guide to Information Security: Threats, Challenges, and Solutions delivers.

Mark Egan and Tim Mather have designed this book to follow a logical progression, starting with the "why" of security management: Why can't the IT department keep systems secure? What does security mean to our customers? How can it detract from (or enhance) our business? The book provides these answers in terms an executive will understand, using a combination of established management principles and simple analogies. Eschewing fear-mongering, the authors use more of a carrot than a stick approach that suits its target audience well.

Infosec Bookshelf

Read Chapter 3 of this book

More book chapters and reviews

Do you agree with this review? Share your opinion.


Once establishing this foundation, The Executive Guide to Information Security devotes the bulk of its pages to laying out a high-level road map for maintaining a comprehensive in-house security program. There's a lot of information here about building effective security teams, leveraging existing resources and running ongoing programs, but it's probably not enough to implement a plan. The emphasis isn't on how to establish the program, but on what to expect from a CISO and how to best support security.

The book is most appropriate for U.S.-based medium- to large-sized enterprises. Executives of small or foreign organizations should probably look elsewhere.

The Executive Guide to Information Security demands absolutely no previous technical or security background, but imparts a surprising amount of information without drowning the reader in a sea of jargon. This must-read book is a near-perfect executive summary of security challenges and practices, with an emphasis on the business and regulatory environment in which security operates.

Do you agree with this review? Sound Off below to share your opinion.

This was first published in April 2005

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: