Book Table of Contents

Training Basics
Training (and communications) must be comprehensive, but tailored; interesting; and easy (for them) to understand and to understand why. The latter, in my opinion, is the greatest challenge an information security trainer faces. End user training should focus on -- indeed, do a "deep dive" on -- the topics which they need to understand, and ignore everything else. To make it interesting, you, the trainer, must make it relevant, useful, engaging, and fun...

Infosec 101
When teaching "InfoSec 101," I reflect back on my early career as a reporter, and try to answer the standard questions: who, what, why, where, when, and how. Why? Because our stuff is valuable. What? Information security professionals frequently reference the "CIA triad," which stands for confidentiality, integrity, and availability. Where? Everywhere we can, which often is referred to as defense in depth (DiD). When? The simple answer is always: 24/7/365. How? A combination of solutions which are technical, physical, and administrative...

Technical Security
Touching on some of the common types of information security hardware such as firewalls, on up to the "big-picture" concepts like the workings of the Internet, makes sense. An overview of the "propeller head" stuff provides a framework for why certain seemingly arbitrary rules -- such as why confidential information should not be sent in a "regular" email -- need to be followed...

Physical Security
The average employee probably does not think of physical devices as information security controls. But clearly, they are just as important as technical and administrative controls. After all, if someone could walk in the front door and take away one of your servers -- blade servers are pretty small, you know -- in time he would be able to break through the electronic defenses. So secure the castle. Build fences. Lock doors. Put up cameras. Hire guards...

Administrative Security
Administrative controls are perhaps most important, because they most directly impact your people. On the one hand, they are the simplest, since all it takes is education. But they also are the hardest, because people must understand them, accept them, and implement them correctly. At the heart of administrative security are your policies and standards, which form the basis of your organization's entire information security program...

This book should be read by anyone who:
1) Cares about the security and privacy of their online information, and wants to know how to take steps to protect it,
2) Wants to "do the right thing" and ensure that they do not inadvertently compromise their employer's, or their own, sensitive information, and
3) Believes that crime is crime, it should be stopped, and wants to know what concrete steps he or she can be take to reduce cybercrime and minimize its impacts and that should be everyone.